5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_heif_.dll
Size

2.9MB
MD5

de1fae32385231bf0beecbfaca4eb9f8
SHA1

638073820ce47031c9b9c0c972d34201f42926cd
SHA256

cf499c73b1e6ec7cc67c205f3e6f4e88d9ad1eee5c59a7357bab13c5cc2670bf
SHA512

0fb03f7b237612e61219c9d9d337fcb2dc04dac50d65637dec0f172420958c040f62e0c0277713fb3d355b94e8b54ee9ff2afe6faa98b4a613af76b8a6bd3c64
SSDEEP

49152:Vwuf96BIx41/LooCp7hkMJGUyO9ea7xnPfBFg3CbypD2lMJd05FXDDEBaK+gy6FX:Vwuf96BIxO6p7hkMJGUfAWP/KJFXzHQc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1848	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_heif_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_heif_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 224
    3⤵
    - Program crash
    PID:1788

memory/1848-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download