5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
89s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2022 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_glib_.dll
Size

2.0MB
MD5

cfdc302103282443af735d2dfe6a599e
SHA1

eabc2e747b5459a7856897fa37f9f9027a8deb55
SHA256

370ab401152df2fcd221c6c80a0d357055905f0706ce6fc14b26a0a30c014c70
SHA512

6fbb88954dd6fff83a93cc02b781751aad231e1ec02d9e839ece2cc803b7d77264ecb98cac431a20f896d5e6cf86b78abc85af7404beea37ecc8233969b3fc67
SSDEEP

49152:POeWQ+7v21O3s6Ni6fWgE5n6ddjbCV5Ltv8eyw3:VWQY79Ni6TE5nEJ+V5Jyw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4188	1428	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 1428	3484	rundll32.exe	80
PID 3484 wrote to memory of 1428	3484	rundll32.exe	80
PID 3484 wrote to memory of 1428	3484	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_glib_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_glib_.dll,#1
  2⤵
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 680
    3⤵
    - Program crash
    PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 1428
1⤵
PID:5080