5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
28s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_harfbuzz_.dll
Size

1.0MB
MD5

7b386947c171875d20495215e321c597
SHA1

73d19493df13287305887029ad5bb58eedb3e274
SHA256

2f593da8f79218ffb1357c24e3496de5fb54fbb7bbd834b69726a9e9dda3e644
SHA512

a43ca6dd89b3e0bc480335fed02d46f25b4de6040a49a0c5bef1f72548180f38abada54427bf4362780b82b789dca3fdc7aaaa7e3a570def0e95ba6fe2ed35fc
SSDEEP

24576:U9y6Qvy9RtoR+sFsU3GCQkdguFK0UROj+d047ZrwDyFD:2Qvy9t0wrwDO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1284	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 1284	672	rundll32.exe	26
PID 672 wrote to memory of 1284	672	rundll32.exe	26
PID 672 wrote to memory of 1284	672	rundll32.exe	26
PID 672 wrote to memory of 1284	672	rundll32.exe	26
PID 672 wrote to memory of 1284	672	rundll32.exe	26
PID 672 wrote to memory of 1284	672	rundll32.exe	26
PID 672 wrote to memory of 1284	672	rundll32.exe	26
PID 1284 wrote to memory of 1964	1284	rundll32.exe	27
PID 1284 wrote to memory of 1964	1284	rundll32.exe	27
PID 1284 wrote to memory of 1964	1284	rundll32.exe	27
PID 1284 wrote to memory of 1964	1284	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_harfbuzz_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_harfbuzz_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 236
    3⤵
    - Program crash
    PID:1964

memory/1284-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download