cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e

Resubmissions

31-03-2023 23:15

31-03-2023 23:09

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 23:09

Target

IGG-REDCON.v1.3.0/SmartSteamEmu/Plugins/SSEFirewall.dll
Size

16KB
MD5

d51335bfb0a6ae5cdff188f221dec879
SHA1

655c26e2252cb37691497b2100c3b1222ee4eb15
SHA256

0c96d0803d8a6591c625221f83b444fc78cb2bdf7910e5d5401b10733abd2df3
SHA512

a5204f528ac581ddd41101e97cb9fa03a370fca763abf262ec4cb7bce4e057ccfd368f427ae63fc6de535fbb0235517832538c450b6486f3da3e9f89e6a79926
SSDEEP

384:VYAxm+gWN5bCpg+NQiKTiZCWdDMj+kZOZKPVI3:eKgWN9ObhZCWdDMjLOZKdI3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1636 1640 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1636	1640	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1720 wrote to memory of 1640	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 1640	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 1640	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 1640	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 1640	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 1640	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 1640	1720	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1636	1640	rundll32.exe	WerFault.exe
PID 1640 wrote to memory of 1636	1640	rundll32.exe	WerFault.exe
PID 1640 wrote to memory of 1636	1640	rundll32.exe	WerFault.exe
PID 1640 wrote to memory of 1636	1640	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 224
3⤵
- Program crash
PID:1636