c52423a7641cb6c932fb45b9827685ab13c2028a783ad930b90560e42db5c1cd

Analysis

max time kernel
299s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2023 16:34

Target

SynapseCrack/bin/libGLESv2.dll
Size

6.4MB
MD5

48bd3bf564d6592417ee5cae16e34e6e
SHA1

f29f91d5863be99267cec7bbe8cb51159a7a3adf
SHA256

53a7ea40cd589683dfb57ee0f187d6f3e373b2df5a3e0129c41a5c1e7de5d0c0
SHA512

c9da5cc25b29bf1b5cdc3de42650e6d893ae89b8451fb67a8a1e4f5df9d71d503b5e010a17540d46e96c1244d58c2490f0b8d5380a98337cbb7bf13b69101683
SSDEEP

98304:+/p3sY6QaLuk1s0EU0qf8zRfU4WIIIMBtLLdAr16KH57wemx7+lw:E36QffqfGpU4WIyFLdoEQWk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3116	2460	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2460	4272	rundll32.exe	82
PID 4272 wrote to memory of 2460	4272	rundll32.exe	82
PID 4272 wrote to memory of 2460	4272	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SynapseCrack\bin\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SynapseCrack\bin\libGLESv2.dll,#1
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 612
    3⤵
    - Program crash
    PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2460 -ip 2460
1⤵
PID:2700