55dd41e0614ba9b4406c926cc1fd970351d14d11552f3a85d522af46b0a49e46

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 18:33

Target

SynapseX revamaped V1.2/bin/CefSharp.Core.dll
Size

1.3MB
MD5

a44554d38b7a25a7ab2320fe731c5298
SHA1

c287a88fd3a064b387888f4bbc37a0630c877253
SHA256

35980974bdba6d5dd6a4dc1072e33aab77f72f56c46779cb0216e4801dcc36ab
SHA512

bd8956b7e8ca6d1129fbbb950dd913183b3e92601c2c900aed26d695782e4663654ac57074e1f0f2efcf9cced969487162910dc9bb52b42572d61994b07f2aad
SSDEEP

24576:yXIdphyvfDVKyFnp89jCbBNr0s7HQAqcwYhPolDexla9e6dhkOi0nK+++evP4ZcC:HsJKyzNr0s7HQAqcwYhPolDexla9e6dp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2748 2372 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2748	2372	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2980 wrote to memory of 2372	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2372	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2372	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2372	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2372	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2372	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2372	2980	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2748	2372	rundll32.exe	WerFault.exe
PID 2372 wrote to memory of 2748	2372	rundll32.exe	WerFault.exe
PID 2372 wrote to memory of 2748	2372	rundll32.exe	WerFault.exe
PID 2372 wrote to memory of 2748	2372	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\CefSharp.Core.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\CefSharp.Core.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 796
3⤵
- Program crash
PID:2748

memory/2372-0-0x0000000004DF0000-0x0000000004F4A000-memory.dmp

Filesize
1.4MB

Download