9641dd61967ff63f4c03b525693df3cb060a91ace3b8446aa31742a7297c282c

Analysis

user interaction
yes
max time kernel
693s
max time network
408s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 12:43

Target
Spoofer ImGui Base.exe
Size 1.4MB
Sample260419-pybwcaax8m
SHA256 9641dd61967ff63f4c03b525693df3cb060a91ace3b8446aa31742a7297c282c
MD5 bf50ac70f7b4544f5a18ea55b04e02a4
SHA1 6a7f376a844d33eecef313fb4f5e4f5706d75812
SHA512 9c6b9c605766fc10edb562a4b940f94b80a5b12e66055c67aec5ee2ac582e10108889e4016b8a48aa12697242451582cf86d9ca2cff7ab51492f5366b8787cfe
SSDEEP 24576:+69pzSnMF09AspQ+QkYafIRvnJ7k/j9CtWBlsSuGKFzFTSpkPb6n:ytp7QzafmnBkgWBeFTFOn
TLSH
T114657CC3A29C83C5D62FC6B6C10BA737E8B67CB451391D2B32F688625F536136C6AD41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3880	Spoofer ImGui Base.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1352	3880	Spoofer ImGui Base.exe	79

C:\Users\Admin\AppData\Local\Temp\Spoofer ImGui Base.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer ImGui Base.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\Windows\IME\IMEKR\DICTS\network.exe
  2⤵
  PID:1352

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact