5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
125s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_jbig_.dll
Size

47KB
MD5

ffe13ccc4f2e6c38f2659f3dce87318d
SHA1

a27726fa55179b18cc49c1d1eb4d238c8697ae6d
SHA256

e0e1ca02ec41d2c600407d8f059f6c1d83904983009cd482dafe06a79ff41d35
SHA512

c3f5cb28bb08ff188766a0db4c2c6aef778d8791e7cac9c00089b547725d58588357fec1aec867837a9f9cc4097c52cd1a972dddef06e6b0c55b7e7ac04c934a
SSDEEP

768:DyxndlKDXeVXA8mJEH4Z5GoTpTcAuW9WpW+WDjpnXPg07b33H7sNTESpu1zTj7:Dy5aqVXA8HKbM61zTj7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4212	5064	rundll32.exe	78
PID 5064 wrote to memory of 4212	5064	rundll32.exe	78
PID 5064 wrote to memory of 4212	5064	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_jbig_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_jbig_.dll,#1
  2⤵
  PID:4212