55dd41e0614ba9b4406c926cc1fd970351d14d11552f3a85d522af46b0a49e46

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 18:33

Target

SynapseX revamaped V1.2/bin/libGLESv2.dll
Size

6.4MB
MD5

48bd3bf564d6592417ee5cae16e34e6e
SHA1

f29f91d5863be99267cec7bbe8cb51159a7a3adf
SHA256

53a7ea40cd589683dfb57ee0f187d6f3e373b2df5a3e0129c41a5c1e7de5d0c0
SHA512

c9da5cc25b29bf1b5cdc3de42650e6d893ae89b8451fb67a8a1e4f5df9d71d503b5e010a17540d46e96c1244d58c2490f0b8d5380a98337cbb7bf13b69101683
SSDEEP

98304:+/p3sY6QaLuk1s0EU0qf8zRfU4WIIIMBtLLdAr16KH57wemx7+lw:E36QffqfGpU4WIyFLdoEQWk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2612 2140 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2612	2140	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\libGLESv2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\libGLESv2.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 220
3⤵
- Program crash
PID:2612