83b1cf864bc6c51f8bb092ddfe9710b993a0df3bd61d9aa7e6ca9fb72d495bbc

Analysis

max time kernel
128s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:20

Target

Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/x86/SSEOverlay.dll
Size

855KB
MD5

f204ca9b0cbc6bccf9df5549ae16b5cf
SHA1

249772a9ca13510e7db6485c42963b72e7be0484
SHA256

c7267e2e20e02bb0ca868f8dbb0a0a4199a3cfb2c4ecfba7f297b15b81e5b31a
SHA512

55363ce555be3479259ef9ee54f90d7fe65c96f633de020e05f991c76a2a365b47efe50a930f784b2cddec932650b24652505a2e0e4a99aee8121fffb1a327e0
SSDEEP

12288:7sIylIZ9C4IgNeC5s5NS9Wv1821bZQIi/1GpABaOKNoHBinF086fgTymF50EcJW:7sIylITC4I0051mZ4pAONKAmfz/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2520 1996 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2520	1996	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1020 wrote to memory of 1996	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1996	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1996	1020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
2⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 600
3⤵
- Program crash
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1996 -ip 1996
1⤵
PID:5112