4691b5820190679e577d8c7a0967e3328e1448ac8292de87b603cd9afe200364

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:28

Target

Spoofer/vcruntime140_cor3.dll
Size

88KB
MD5

9acaf9bc53258825a40d627d052f73c4
SHA1

60b3f43b6de95b6fb1347c14a81ad3952aa98e94
SHA256

83d399f5b8bec72224b04c988ebfe318e86345b24a4c9a92918256caa69bb2f0
SHA512

8645bece3eea5a60101a3e4f781f90bbc49689fe479b86d7ab956d7c1cb81a52303b60f8f7c24035c71e1c4d638708aa1ea44e69d68c7e7408737338a1c81fbc
SSDEEP

1536:sb8h/b8bgkjohTX6pz0y9v+xSUKF1IuCmg+KecbWJDa79zu5X/Izu6:sbWUgkOTX6ey9v+xSjFyuKecbW5gYwB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1312 1204 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1312	1204	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1204	2368	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1312	1204	rundll32.exe	WerFault.exe
PID 1204 wrote to memory of 1312	1204	rundll32.exe	WerFault.exe
PID 1204 wrote to memory of 1312	1204	rundll32.exe	WerFault.exe
PID 1204 wrote to memory of 1312	1204	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\vcruntime140_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\vcruntime140_cor3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 220
3⤵
- Program crash
PID:1312