cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e

Resubmissions

31-03-2023 23:15

31-03-2023 23:09

max time kernel
78s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 23:09

Target

IGG-REDCON.v1.3.0/SmartSteamEmu/Plugins/SSEFirewall.dll
Size

16KB
MD5

d51335bfb0a6ae5cdff188f221dec879
SHA1

655c26e2252cb37691497b2100c3b1222ee4eb15
SHA256

0c96d0803d8a6591c625221f83b444fc78cb2bdf7910e5d5401b10733abd2df3
SHA512

a5204f528ac581ddd41101e97cb9fa03a370fca763abf262ec4cb7bce4e057ccfd368f427ae63fc6de535fbb0235517832538c450b6486f3da3e9f89e6a79926
SSDEEP

384:VYAxm+gWN5bCpg+NQiKTiZCWdDMj+kZOZKPVI3:eKgWN9ObhZCWdDMjLOZKdI3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4424 3868 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4424	3868	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4036 wrote to memory of 3868	4036	rundll32.exe	rundll32.exe
PID 4036 wrote to memory of 3868	4036	rundll32.exe	rundll32.exe
PID 4036 wrote to memory of 3868	4036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
2⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 604
3⤵
- Program crash
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3868 -ip 3868
1⤵
PID:808