5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
123s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_jpeg-turbo_.dll
Size

540KB
MD5

bf8cbf08c9736a60b2eb0c576db4e52d
SHA1

45323ab9192dc28d903b98bb370b09098a6da62c
SHA256

85b5e6597426f9269381e4bb1c0efca0da82189649164065c6e9f1f5dbb9d119
SHA512

9a333c5360f5d05a4216406d24250b4a107b2f336adae389051364832008f18a592e980ed97bcd27ac85d826614da814599c2ccc2d58b24d9d5aefda19737dc3
SSDEEP

6144:VhF7tvX/VZq5Gv1ydDv/EyGKFwoEXJGw/To4GyWC4EuD0qoFuk7e1McEs:VhF7tvXnqYvcvOjJGw/rWdD0duk7e1M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3560	4444	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4444	4676	rundll32.exe	78
PID 4676 wrote to memory of 4444	4676	rundll32.exe	78
PID 4676 wrote to memory of 4444	4676	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_jpeg-turbo_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_jpeg-turbo_.dll,#1
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 604
    3⤵
    - Program crash
    PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4444 -ip 4444
1⤵
PID:2020