4691b5820190679e577d8c7a0967e3328e1448ac8292de87b603cd9afe200364

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:28

Target

Spoofer/vcruntime140_cor3.dll
Size

88KB
MD5

9acaf9bc53258825a40d627d052f73c4
SHA1

60b3f43b6de95b6fb1347c14a81ad3952aa98e94
SHA256

83d399f5b8bec72224b04c988ebfe318e86345b24a4c9a92918256caa69bb2f0
SHA512

8645bece3eea5a60101a3e4f781f90bbc49689fe479b86d7ab956d7c1cb81a52303b60f8f7c24035c71e1c4d638708aa1ea44e69d68c7e7408737338a1c81fbc
SSDEEP

1536:sb8h/b8bgkjohTX6pz0y9v+xSUKF1IuCmg+KecbWJDa79zu5X/Izu6:sbWUgkOTX6ey9v+xSjFyuKecbW5gYwB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4036 4516 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4036	4516	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 4516	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 4516	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 4516	2724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\vcruntime140_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\vcruntime140_cor3.dll,#1
2⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 600
3⤵
- Program crash
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4516 -ip 4516
1⤵
PID:1472