aaf20e1523773d6a7f05297cb48c01b63ce2538ea47403191ff6cdc9f364b148

Analysis

max time kernel
1481s
max time network
1495s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
13-05-2024 17:36

Target

Synapse-X-Revamped-main/libGLESv2.dll
Size

6.4MB
MD5

48bd3bf564d6592417ee5cae16e34e6e
SHA1

f29f91d5863be99267cec7bbe8cb51159a7a3adf
SHA256

53a7ea40cd589683dfb57ee0f187d6f3e373b2df5a3e0129c41a5c1e7de5d0c0
SHA512

c9da5cc25b29bf1b5cdc3de42650e6d893ae89b8451fb67a8a1e4f5df9d71d503b5e010a17540d46e96c1244d58c2490f0b8d5380a98337cbb7bf13b69101683
SSDEEP

98304:+/p3sY6QaLuk1s0EU0qf8zRfU4WIIIMBtLLdAr16KH57wemx7+lw:E36QffqfGpU4WIyFLdoEQWk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

904 1032 WerFault.exe rundll32.exe

pid	pid_target	process	target process
904	1032	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5108 wrote to memory of 1032	5108	rundll32.exe	rundll32.exe
PID 5108 wrote to memory of 1032	5108	rundll32.exe	rundll32.exe
PID 5108 wrote to memory of 1032	5108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Synapse-X-Revamped-main\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Synapse-X-Revamped-main\libGLESv2.dll,#1
2⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 460
3⤵
- Program crash
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1032 -ip 1032
1⤵
PID:1148