83b1cf864bc6c51f8bb092ddfe9710b993a0df3bd61d9aa7e6ca9fb72d495bbc

Analysis

max time kernel
133s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:20

Target

Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/SSEFirewall.dll
Size

16KB
MD5

3c16a45dd3b0d6214d5e292982e9ad22
SHA1

12ff60924e97c815e288a301fa705fc00eb832c5
SHA256

56bff3b129a0f05cfb9f125a32aa8d8d1aac4c8668614c5636adc0786955757b
SHA512

43b1719bea0cd24b6a50440f305fd534275f256bfbecb7de2540692a6380b7f6e53e6fe2b0d279dfbc57ad0563b1070098369ec6bf10ecf6382b2efa6c925133
SSDEEP

384:VnAxm+gWN5bCpg+NQiKTiZCWPDJj+kZOZKPVC3:hKgWN9ObhZCWPDJjLOZKdC3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4404 4868 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4404	4868	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4936 wrote to memory of 4868	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 4868	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 4868	4936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\SSEFirewall.dll,#1
2⤵
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 604
3⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
1⤵
PID:4968