8c2b97577be79c194acac8e8781aac24d9c76caa9a7e8befaa407bdc6658bca3

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/12/2022, 02:20

Target

HiddenDeepFixOnly/SteamOverlay32.dll
Size

80KB
MD5

140a1ed6312c3b87f70263a9dc8b7d0c
SHA1

3cca56c898152d8d312e561cd5a5c0e2ce05dfee
SHA256

4be6ce2b26cea97546f1d13ef5179be93a0ee89f5aab39fffc51e34a82d5abd6
SHA512

1a2a03c179929a1d390ecc4fe2a0689bb99ce631980252f2be2c58a20945d0e3c6ca79e3798cec85d6647c0f18f7431f909d460ac48622db17f02a95be6f9146
SSDEEP

1536:A7tEBbhuTNQapZ8pvjpLOK2v5RQ1XsWdcdbYoke0OIsFjR:o2huTNVZ8pv4BRBbYoke0ed

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	524	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 524	3972	rundll32.exe	78
PID 3972 wrote to memory of 524	3972	rundll32.exe	78
PID 3972 wrote to memory of 524	3972	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HiddenDeepFixOnly\SteamOverlay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HiddenDeepFixOnly\SteamOverlay32.dll,#1
  2⤵
  PID:524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 572
    3⤵
    - Program crash
    PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 524 -ip 524
1⤵
PID:824