4e82af63419d8f11e86d687eb3eefcfac517e356979b2738806aa518332ef912

Analysis

max time kernel
123s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 09:08

Target
SpooferPack/Spoofer(NEW VERSION)/Additional/CiWinCng32.dll
Size 2.6MB
Sample240609-k4ef7sge2v
SHA256 ce67945c1f951d38aa65440fcb5145bc9bac340ac1b23ac2edb91ffd2c13536e
MD5 23bc06067a83155d329d330c3b018223
SHA1 f7fadcdc733d0b74706d270724a45c56e8486d6d
SHA512 16bb0c60dd139017494a78ec7cfeac23636c623dd30ae4a4350da463e88502e791ce55f7db17426df6248cffb1187eb261da275043a09aa992b27dadfb656f50
SSDEEP 49152:TmpDEkl6TwVeoZItytWBlz0tPsvOby8uvCDZGUfITVbBSd4:TmpDEg60UUoytWT0evOpxm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4440	1388	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1388	1216	rundll32.exe	91
PID 1216 wrote to memory of 1388	1216	rundll32.exe	91
PID 1216 wrote to memory of 1388	1216	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpooferPack\Spoofer(NEW VERSION)\Additional\CiWinCng32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpooferPack\Spoofer(NEW VERSION)\Additional\CiWinCng32.dll",#1
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 632
    3⤵
    - Program crash
    PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1388 -ip 1388
1⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:8
1⤵
PID:1380