5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
69s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_harfbuzz_.dll
Size

1.0MB
MD5

7b386947c171875d20495215e321c597
SHA1

73d19493df13287305887029ad5bb58eedb3e274
SHA256

2f593da8f79218ffb1357c24e3496de5fb54fbb7bbd834b69726a9e9dda3e644
SHA512

a43ca6dd89b3e0bc480335fed02d46f25b4de6040a49a0c5bef1f72548180f38abada54427bf4362780b82b789dca3fdc7aaaa7e3a570def0e95ba6fe2ed35fc
SSDEEP

24576:U9y6Qvy9RtoR+sFsU3GCQkdguFK0UROj+d047ZrwDyFD:2Qvy9t0wrwDO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	4620	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4620	4684	rundll32.exe	84
PID 4684 wrote to memory of 4620	4684	rundll32.exe	84
PID 4684 wrote to memory of 4620	4684	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_harfbuzz_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_harfbuzz_.dll,#1
  2⤵
  PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 676
    3⤵
    - Program crash
    PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4620 -ip 4620
1⤵
PID:1536