cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e

Resubmissions

31-03-2023 23:15

31-03-2023 23:09

max time kernel
20s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 23:09

Target

IGG-REDCON.v1.3.0/SmartSteamEmu/Plugins/SSEFirewall64.dll
Size

20KB
MD5

f5753caf0fdf0aaaff4dd542d2eaf441
SHA1

9af901c309fd5e2d1c263597ed13b5ca71826390
SHA256

5ad094eededaee23d57b9248c74116e94032c83053bb2e042e4624bfcd5a0490
SHA512

9efe0ac8d7a4dc5f01d3d32ba3729ee1fd44b8e33892377fd893ea7eacf09d2cf70c215a9a2c913e69e07838fc9c9f4fb31f5a47b67341c302c3b306e9802e1e
SSDEEP

384:crMgaY2ey+sW5K0i00k72NoXPeW+F4MGTCxDJAzm6Olxcat:eMZY2d+D5A7k72SXPB44MGTCzAz5Olya

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1984 2008 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1984	2008	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2008 wrote to memory of 1984	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1984	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1984	2008	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\SSEFirewall64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2008 -s 84
2⤵
- Program crash
PID:1984