5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
30s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_cairo_.dll
Size

965KB
MD5

56bfb25e7e82f9f63a7b7053ee39709b
SHA1

0bf8be3fb28f3a790105202d4813ac2a142f522a
SHA256

b7838c51749679691a667ac9f41564e620adffaa221ebef2d1fc4622130d1529
SHA512

0dca9f5e19d7196ec3fc6ac647a614582cbfbcfb13bb14ffe084bb49d7aa6fc8006236480ea68d4c20c9363255462cd19c72a622157238799c1785fd0a7ce9c2
SSDEEP

24576:OFuFJU+OIbD34vsSd9oseZXNI/Fo4MAKleDqB9THgi4pvEchZ9eO5gUDn:/4doXNIp9qeEchZ9eO5g2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1888	840	rundll32.exe	27
PID 840 wrote to memory of 1888	840	rundll32.exe	27
PID 840 wrote to memory of 1888	840	rundll32.exe	27
PID 840 wrote to memory of 1888	840	rundll32.exe	27
PID 840 wrote to memory of 1888	840	rundll32.exe	27
PID 840 wrote to memory of 1888	840	rundll32.exe	27
PID 840 wrote to memory of 1888	840	rundll32.exe	27
PID 1888 wrote to memory of 2024	1888	rundll32.exe	28
PID 1888 wrote to memory of 2024	1888	rundll32.exe	28
PID 1888 wrote to memory of 2024	1888	rundll32.exe	28
PID 1888 wrote to memory of 2024	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_cairo_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_cairo_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 228
    3⤵
    - Program crash
    PID:2024

memory/1888-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download