5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
33s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_MagickWand_.dll
Size

946KB
MD5

f2e5eaa05194d2ac39f1a8970e8eb862
SHA1

5931afed54fd0cb0f1a2c254e40728a8cebc5e23
SHA256

e1f136ab2515f3fbd0808e5f7357ba676b30529cd8ede4924187b5f29583a9b7
SHA512

387d6942217f2c488616f2dc7a01bd18218e27208f16ccda66ab6254f885170043d5050557cd184f3ebcec601f91884b934badc31268221e97596e949a3bc37a
SSDEEP

24576:xzufKiTU6baAJa5n3Z0GRW3KBL/uVRJk:xbF6b8EISLk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	1704	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1704	1528	rundll32.exe	26
PID 1528 wrote to memory of 1704	1528	rundll32.exe	26
PID 1528 wrote to memory of 1704	1528	rundll32.exe	26
PID 1528 wrote to memory of 1704	1528	rundll32.exe	26
PID 1528 wrote to memory of 1704	1528	rundll32.exe	26
PID 1528 wrote to memory of 1704	1528	rundll32.exe	26
PID 1528 wrote to memory of 1704	1528	rundll32.exe	26
PID 1704 wrote to memory of 1684	1704	rundll32.exe	27
PID 1704 wrote to memory of 1684	1704	rundll32.exe	27
PID 1704 wrote to memory of 1684	1704	rundll32.exe	27
PID 1704 wrote to memory of 1684	1704	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_MagickWand_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_MagickWand_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 240
    3⤵
    - Program crash
    PID:1684

memory/1704-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download