5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_glib_.dll
Size

2.0MB
MD5

cfdc302103282443af735d2dfe6a599e
SHA1

eabc2e747b5459a7856897fa37f9f9027a8deb55
SHA256

370ab401152df2fcd221c6c80a0d357055905f0706ce6fc14b26a0a30c014c70
SHA512

6fbb88954dd6fff83a93cc02b781751aad231e1ec02d9e839ece2cc803b7d77264ecb98cac431a20f896d5e6cf86b78abc85af7404beea37ecc8233969b3fc67
SSDEEP

49152:POeWQ+7v21O3s6Ni6fWgE5n6ddjbCV5Ltv8eyw3:VWQY79Ni6TE5nEJ+V5Jyw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1912	WerFault.exe	20

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1912	1340	rundll32.exe	20
PID 1340 wrote to memory of 1912	1340	rundll32.exe	20
PID 1340 wrote to memory of 1912	1340	rundll32.exe	20
PID 1340 wrote to memory of 1912	1340	rundll32.exe	20
PID 1340 wrote to memory of 1912	1340	rundll32.exe	20
PID 1340 wrote to memory of 1912	1340	rundll32.exe	20
PID 1340 wrote to memory of 1912	1340	rundll32.exe	20
PID 1912 wrote to memory of 1628	1912	rundll32.exe	29
PID 1912 wrote to memory of 1628	1912	rundll32.exe	29
PID 1912 wrote to memory of 1628	1912	rundll32.exe	29
PID 1912 wrote to memory of 1628	1912	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_glib_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_glib_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 236
    3⤵
    - Program crash
    PID:1628

memory/1912-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download