ce824d6210e678b8df7985f6b81e09e18835b3b316f7df2e6e08fb17a48dd833

Analysis

max time kernel
28s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2022, 13:36

Target

moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_16/UranSpoofer_Secure/UranSpoofer.exe
Size

4.8MB
MD5

22d8376b6eac1a3b8ebb09ba1e6e5479
SHA1

a6b1713d878b40742d77306cfc4587e55cc172e8
SHA256

c56e4fd69ba58760b8fc0d5f2e57e4a4f5924eb9078efaa86ec2482ca7e7aeaa
SHA512

bb42c8fa88ee672678b223c4e036b2d2062c9d58d2aae5a792f7480a909fcd08485d1c9cae99e11376caa7c36e4ea769851aad0e0558a26a8836cfa08e6342bf
SSDEEP

98304:h1K3nCaykSH58EAlSEJePDbHkvsHLbs+agd9nKTUP0sCDqQbgOpxvZq94V:h1UnK55AebbEv1Od9n3PAFgOpPIS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	1592	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	UranSpoofer.exe

C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\publikuj\Application Files\UranSpoofer_1_0_0_16\UranSpoofer_Secure\UranSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\publikuj\Application Files\UranSpoofer_1_0_0_16\UranSpoofer_Secure\UranSpoofer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1220
  2⤵
  - Program crash
  PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1592 -ip 1592
1⤵
PID:3872

memory/1592-132-0x0000000000470000-0x0000000000944000-memory.dmp

Filesize
4.8MB

Download
memory/1592-133-0x00000000059F0000-0x0000000005F94000-memory.dmp

Filesize
5.6MB

Download
memory/1592-134-0x0000000005440000-0x00000000054D2000-memory.dmp

Filesize
584KB

Download