c52423a7641cb6c932fb45b9827685ab13c2028a783ad930b90560e42db5c1cd

Analysis

max time kernel
299s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2023 16:34

Target

SynapseCrack/bin/libGLESv2.dll
Size

6.4MB
MD5

48bd3bf564d6592417ee5cae16e34e6e
SHA1

f29f91d5863be99267cec7bbe8cb51159a7a3adf
SHA256

53a7ea40cd589683dfb57ee0f187d6f3e373b2df5a3e0129c41a5c1e7de5d0c0
SHA512

c9da5cc25b29bf1b5cdc3de42650e6d893ae89b8451fb67a8a1e4f5df9d71d503b5e010a17540d46e96c1244d58c2490f0b8d5380a98337cbb7bf13b69101683
SSDEEP

98304:+/p3sY6QaLuk1s0EU0qf8zRfU4WIIIMBtLLdAr16KH57wemx7+lw:E36QffqfGpU4WIyFLdoEQWk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3116 2460 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3116	2460	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4272 wrote to memory of 2460	4272	rundll32.exe	rundll32.exe
PID 4272 wrote to memory of 2460	4272	rundll32.exe	rundll32.exe
PID 4272 wrote to memory of 2460	4272	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SynapseCrack\bin\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SynapseCrack\bin\libGLESv2.dll,#1
2⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 612
3⤵
- Program crash
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2460 -ip 2460
1⤵
PID:2700