4e82af63419d8f11e86d687eb3eefcfac517e356979b2738806aa518332ef912

Analysis

max time kernel
128s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 09:08

Target
SpooferPack/Spoofer(NEW VERSION)/DLL/Qt5Core.dll
Size 4.9MB
Sample240609-k4ef7sge2v
SHA256 85e29fd8a95f23a8af5ed0d0e93d18fcc30f95affbb75a1fcb20b873e8e5d8b0
MD5 aa6ce2c97b80c323cbe9f86dbd6d263e
SHA1 089f6915aa650b0cc7dcc53a7e4365310523dd68
SHA512 dd3e1684306624dbf0398021b1fa8833a348dec9271b5eb224c9a59877f832ce1aedb9c4f6ef84c061bf3585f3a5628e9f49296deab542b36ae3fa2230f3b417
SSDEEP 98304:D/cPFLQEJuMEGJsv6tWKFdu9C9Ed74Gx80MEcUsk80MEcUsk80ycUsk80M6Ou:DsRJsv6tWKFdu9C9y7g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1032	4880	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4880	3308	rundll32.exe	90
PID 3308 wrote to memory of 4880	3308	rundll32.exe	90
PID 3308 wrote to memory of 4880	3308	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpooferPack\Spoofer(NEW VERSION)\DLL\Qt5Core.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpooferPack\Spoofer(NEW VERSION)\DLL\Qt5Core.dll",#1
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 684
    3⤵
    - Program crash
    PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 4880
1⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3916,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
1⤵
PID:3824