cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e

Resubmissions

31-03-2023 23:15

31-03-2023 23:09

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 23:09

Target

IGG-REDCON.v1.3.0/SmartSteamEmu/Plugins/x86/SSEOverlay.dll
Size

850KB
MD5

1052fc288b2b7afa3bccefcc925de8ae
SHA1

e9b1e32774d0920057c29e9be530346ce382b83d
SHA256

2093ac632a1474ecd89ae6e615892bf7f0dc5547aea73391ba7b89c023cf56da
SHA512

0b47f8164693a173fc54c99df97f233f2cf0815c92fb6f930298d963647030322d3a84cb166395e6e06926dee0b982830779b1eee06e2f049c06ec9012e7b9f1
SSDEEP

24576:ZO8M20nkaZfwn+f4ezu8yWKuIoWrYg3v4I:ZV0nd2Mu8tcLf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 2012	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2012	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2012	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2012	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2012	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2012	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2012	2000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
2⤵
PID:2012