045f15732d3999f475ae5e25b88011f86c059444a55817b0ce1a60beee4c347f

Resubmissions

18/10/2022, 09:52

18/10/2022, 09:48

03/09/2022, 05:48

max time kernel
144s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 09:48

Target

Vanguard_Spoofer.exe
Size

697KB
MD5

ac247152e9e48cf792cbc986c39a77b7
SHA1

0174007199120da8d24125430720442373508c98
SHA256

045f15732d3999f475ae5e25b88011f86c059444a55817b0ce1a60beee4c347f
SHA512

e27a7ebc1c4e15dc55fba6c97a83d888d58fe4d4e711c7e77d446f0e0be5c82e57e2f3ef5d2a5bb9a13ec2d85aa295fee1e4dc1fe680c9ace91fb7043b89d56f
SSDEEP

12288:Mg5E6JOtYvjofCHjacgC9DHDw82japb1DOMvSastXAJU0u3KKRSozfg5WdC7O:MgdOtMooGcgC9D5sivvSLtXAJ83KKRSs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1980	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1788	1980	Vanguard_Spoofer.exe	29
PID 1980 wrote to memory of 1788	1980	Vanguard_Spoofer.exe	29
PID 1980 wrote to memory of 1788	1980	Vanguard_Spoofer.exe	29
PID 1980 wrote to memory of 1788	1980	Vanguard_Spoofer.exe	29

C:\Users\Admin\AppData\Local\Temp\Vanguard_Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Vanguard_Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 660
  2⤵
  - Program crash
  PID:1788

memory/1980-54-0x0000000001200000-0x00000000012B4000-memory.dmp

Filesize
720KB

Download
memory/1980-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download