5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_MagickCore_.dll
Size

1.7MB
MD5

ec592be858e52142111c772db17e8a5a
SHA1

f7eb381f0d590c9e0fd614fa3583d9746e11180a
SHA256

81bd64c1647f41d3af0dc4b03aa32b656592b27f3fa833451ab37c931a8bad30
SHA512

e1a350ad1bb4c2bd73dde612492e7c52ae82d08aa70844456ca4db50c1a5ebcc59cceb89c4b48103c325c07d6c54b169b3bc8c5b8af4d36336421354aa096612
SSDEEP

49152:83tjTGLZTDFzxyaQZy7Q4NPRM27VTbKc1IgVu2:83tjTGL+Zy7Ff

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 860	684	rundll32.exe	27
PID 684 wrote to memory of 860	684	rundll32.exe	27
PID 684 wrote to memory of 860	684	rundll32.exe	27
PID 684 wrote to memory of 860	684	rundll32.exe	27
PID 684 wrote to memory of 860	684	rundll32.exe	27
PID 684 wrote to memory of 860	684	rundll32.exe	27
PID 684 wrote to memory of 860	684	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_MagickCore_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_MagickCore_.dll,#1
  2⤵
  PID:860

memory/860-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download