4691b5820190679e577d8c7a0967e3328e1448ac8292de87b603cd9afe200364

Analysis

max time kernel
131s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:28

Target

Spoofer/PresentationNative_cor3.dll
Size

923KB
MD5

2f2a11c99108bffc58bc6fff7e076f01
SHA1

c3a5cf429aacb3529762fd8362cd4e7329a13e27
SHA256

4b00ab43d9466b2bb247061338c7634b5aa85f0288fca4109a54d9aea059af6f
SHA512

7bd3047bb61fc29d065cd19a0624ed22c3ad03c8346b6875d177d77034f53b7819878a9e196b1fd04e02045c773b005fb6d7d4381d1eb4799536a3e4dc4505b5
SSDEEP

24576:T+GZIdVlIVigZtmZQnxQLfsK7mbxZRQxm7Gcs6k5kAY11VywRoD8:TBZIdVlIVidZKxaExQm7e5u11V7RoD8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3468 1676 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3468	1676	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2820 wrote to memory of 1676	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1676	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1676	2820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\PresentationNative_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\PresentationNative_cor3.dll,#1
2⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 612
3⤵
- Program crash
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1676 -ip 1676
1⤵
PID:4596