5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
29s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_jpeg-turbo_.dll
Size

540KB
MD5

bf8cbf08c9736a60b2eb0c576db4e52d
SHA1

45323ab9192dc28d903b98bb370b09098a6da62c
SHA256

85b5e6597426f9269381e4bb1c0efca0da82189649164065c6e9f1f5dbb9d119
SHA512

9a333c5360f5d05a4216406d24250b4a107b2f336adae389051364832008f18a592e980ed97bcd27ac85d826614da814599c2ccc2d58b24d9d5aefda19737dc3
SSDEEP

6144:VhF7tvX/VZq5Gv1ydDv/EyGKFwoEXJGw/To4GyWC4EuD0qoFuk7e1McEs:VhF7tvXnqYvcvOjJGw/rWdD0duk7e1M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1144	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1144	1336	rundll32.exe	26
PID 1336 wrote to memory of 1144	1336	rundll32.exe	26
PID 1336 wrote to memory of 1144	1336	rundll32.exe	26
PID 1336 wrote to memory of 1144	1336	rundll32.exe	26
PID 1336 wrote to memory of 1144	1336	rundll32.exe	26
PID 1336 wrote to memory of 1144	1336	rundll32.exe	26
PID 1336 wrote to memory of 1144	1336	rundll32.exe	26
PID 1144 wrote to memory of 1108	1144	rundll32.exe	27
PID 1144 wrote to memory of 1108	1144	rundll32.exe	27
PID 1144 wrote to memory of 1108	1144	rundll32.exe	27
PID 1144 wrote to memory of 1108	1144	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_jpeg-turbo_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_jpeg-turbo_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 224
    3⤵
    - Program crash
    PID:1108

memory/1144-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download