83b1cf864bc6c51f8bb092ddfe9710b993a0df3bd61d9aa7e6ca9fb72d495bbc

Analysis

max time kernel
207s
max time network
283s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 19:12

Target

Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/SmartSteamEmu/Plugins/x86/SSEOverlay.dll
Size

855KB
MD5

f204ca9b0cbc6bccf9df5549ae16b5cf
SHA1

249772a9ca13510e7db6485c42963b72e7be0484
SHA256

c7267e2e20e02bb0ca868f8dbb0a0a4199a3cfb2c4ecfba7f297b15b81e5b31a
SHA512

55363ce555be3479259ef9ee54f90d7fe65c96f633de020e05f991c76a2a365b47efe50a930f784b2cddec932650b24652505a2e0e4a99aee8121fffb1a327e0
SSDEEP

12288:7sIylIZ9C4IgNeC5s5NS9Wv1821bZQIi/1GpABaOKNoHBinF086fgTymF50EcJW:7sIylITC4I0051mZ4pAONKAmfz/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3480 1364 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3480	1364	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3876 wrote to memory of 1364	3876	rundll32.exe	rundll32.exe
PID 3876 wrote to memory of 1364	3876	rundll32.exe	rundll32.exe
PID 3876 wrote to memory of 1364	3876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\SmartSteamEmu\Plugins\x86\SSEOverlay.dll,#1
2⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 460
3⤵
- Program crash
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1364 -ip 1364
1⤵
PID:4296