55dd41e0614ba9b4406c926cc1fd970351d14d11552f3a85d522af46b0a49e46

Analysis

max time kernel
137s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 17:38

Target

SynapseX revamaped V1.2/bin/CefSharp.Core.dll
Size

1.3MB
MD5

a44554d38b7a25a7ab2320fe731c5298
SHA1

c287a88fd3a064b387888f4bbc37a0630c877253
SHA256

35980974bdba6d5dd6a4dc1072e33aab77f72f56c46779cb0216e4801dcc36ab
SHA512

bd8956b7e8ca6d1129fbbb950dd913183b3e92601c2c900aed26d695782e4663654ac57074e1f0f2efcf9cced969487162910dc9bb52b42572d61994b07f2aad
SSDEEP

24576:yXIdphyvfDVKyFnp89jCbBNr0s7HQAqcwYhPolDexla9e6dhkOi0nK+++evP4ZcC:HsJKyzNr0s7HQAqcwYhPolDexla9e6dp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

220 4400 WerFault.exe rundll32.exe

pid	pid_target	process	target process
220	4400	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1308 wrote to memory of 4400	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 4400	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 4400	1308	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\CefSharp.Core.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\CefSharp.Core.dll",#1
2⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1296
3⤵
- Program crash
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 4400
1⤵
PID:4152

memory/4400-0-0x0000000004980000-0x0000000004ADA000-memory.dmp

Filesize
1.4MB

Download