83b1cf864bc6c51f8bb092ddfe9710b993a0df3bd61d9aa7e6ca9fb72d495bbc

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:20

Target

Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/SSEFirewall.dll
Size

16KB
MD5

3c16a45dd3b0d6214d5e292982e9ad22
SHA1

12ff60924e97c815e288a301fa705fc00eb832c5
SHA256

56bff3b129a0f05cfb9f125a32aa8d8d1aac4c8668614c5636adc0786955757b
SHA512

43b1719bea0cd24b6a50440f305fd534275f256bfbecb7de2540692a6380b7f6e53e6fe2b0d279dfbc57ad0563b1070098369ec6bf10ecf6382b2efa6c925133
SSDEEP

384:VnAxm+gWN5bCpg+NQiKTiZCWPDJj+kZOZKPVC3:hKgWN9ObhZCWPDJjLOZKdC3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2612 2740 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2612	2740	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	WerFault.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	WerFault.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	WerFault.exe
PID 2740 wrote to memory of 2612	2740	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 220
3⤵
- Program crash
PID:2612