83b1cf864bc6c51f8bb092ddfe9710b993a0df3bd61d9aa7e6ca9fb72d495bbc

Analysis

max time kernel
145s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:20

Target

Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu.dll
Size

4.8MB
MD5

ce9cad38253b2991281d3c38e5a07735
SHA1

89eb8dbbf362e59469b37429b50728a80f2b31e2
SHA256

6800f3dc1d74beb791e3e6e12ab0d6202c116a6ce21006ba67a723b64837d17d
SHA512

92ae6fa19894e800a15dc3f28e1702badeaa0c18bb1ecb2cb6de75c0fd75da06d44ec49903dcfaa53107b5f871c85047d5965ef90ed1727f5804cb9f84b0496f
SSDEEP

98304:6JeHhBjfF7w2FWq+PL/pC1VIL8OYKTNzufCpg:De2FaL8MHp

Score

1^/10

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3616 wrote to memory of 4492	3616	rundll32.exe	rundll32.exe
PID 3616 wrote to memory of 4492	3616	rundll32.exe	rundll32.exe
PID 3616 wrote to memory of 4492	3616	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492

memory/4492-0-0x00000000776B2000-0x00000000776B3000-memory.dmp

Filesize
4KB

Download
memory/4492-1-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/4492-2-0x00000000776B2000-0x00000000776B3000-memory.dmp

Filesize
4KB

Download