cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e

Resubmissions

31-03-2023 23:15

31-03-2023 23:09

max time kernel
78s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 23:09

Target

IGG-REDCON.v1.3.0/SmartSteamEmu/Plugins/x86/SSEOverlay.dll
Size

850KB
MD5

1052fc288b2b7afa3bccefcc925de8ae
SHA1

e9b1e32774d0920057c29e9be530346ce382b83d
SHA256

2093ac632a1474ecd89ae6e615892bf7f0dc5547aea73391ba7b89c023cf56da
SHA512

0b47f8164693a173fc54c99df97f233f2cf0815c92fb6f930298d963647030322d3a84cb166395e6e06926dee0b982830779b1eee06e2f049c06ec9012e7b9f1
SSDEEP

24576:ZO8M20nkaZfwn+f4ezu8yWKuIoWrYg3v4I:ZV0nd2Mu8tcLf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3504 3056 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3504	3056	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 3056	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3056	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3056	1724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
2⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 612
3⤵
- Program crash
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3056 -ip 3056
1⤵
PID:556