71ef3cffd5af334bbfd5d99a18171e6c3dcb84e636f428c0be9580da80a8a975

Resubmissions

27/02/2024, 14:23

27/02/2024, 14:20

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 14:20

Target
Temp-Spoofer-LifeTime-main/Loader.exe
Size 412KB
Sample240227-rnqymabe9t
SHA256 868f78eac76904c7c8286243061396fa05a9c6c3cc4315f7a7848a358916ee29
MD5 ca63e74104cfd7ee90019875c0cffe6b
SHA1 44660ef376819e6a0d275885913e3d4f2a7e3f97
SHA512 ca43d646d8f354977fd6a8745622b00098afce08760e850f4865b106407202a36a837683f0cab4c3b4b877f45c36036c9a835f4f40d32bc5881c17a7e016d715
SSDEEP 6144:62X+joLNTy6Yqj2ErwTt3ISmebEeHSTL0pq6vZ4retBHNU3ZkX7rQ:R+kLNhqErwFISmeyUvZ46nm3ZqQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	1984	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2532	1984	Loader.exe	29
PID 1984 wrote to memory of 2532	1984	Loader.exe	29
PID 1984 wrote to memory of 2532	1984	Loader.exe	29
PID 1984 wrote to memory of 2532	1984	Loader.exe	29

C:\Users\Admin\AppData\Local\Temp\Temp-Spoofer-LifeTime-main\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Temp-Spoofer-LifeTime-main\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 128
  2⤵
  - Program crash
  PID:2532

memory/1984-0-0x00000000000F0000-0x0000000000136000-memory.dmp

Download

memory/1984-5-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1984-6-0x00000000000F0000-0x0000000000136000-memory.dmp

Download