f82c91241d92db6e4b9843dcee5e164d13ec25903827fe80cb9848acb1a4e745

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 17:40

Target

hwid spoofer.exe
Size

75.4MB
MD5

eb0cf1a95ffd1d314b96ccb0136bf748
SHA1

dbaff8d30e9fb023550f89fbba7784ca5e3ab9ff
SHA256

f82c91241d92db6e4b9843dcee5e164d13ec25903827fe80cb9848acb1a4e745
SHA512

ee31550d5da75e0f5ac164f7c3283012d2a9991f146f8090ae3c55d0cecbc6b0a375448175248c9e15aea1c09ea2e05558ba978e058a7ec7175f24165b4b9cfa
SSDEEP

1572864:Y08VlFW2omcSk8IpG7V+VPhqerE7WoclKTiY4MHHLeqPNLtDYN0sZsfV0:7KTxomcSkB05awehocMEMHVLtUN0s0

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2384	hwid spoofer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020aa0-1264.dat	upx
behavioral1/memory/2384-1266-0x000007FEF5E40000-0x000007FEF62A5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2384	2772	hwid spoofer.exe	31
PID 2772 wrote to memory of 2384	2772	hwid spoofer.exe	31
PID 2772 wrote to memory of 2384	2772	hwid spoofer.exe	31

C:\Users\Admin\AppData\Local\Temp\hwid spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\hwid spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\hwid spoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\hwid spoofer.exe"
  2⤵
  - Loads dropped DLL
  PID:2384

C:\Users\Admin\AppData\Local\Temp\_MEI27722\python310.dll

Filesize
1.4MB

MD5
190fa7c1e8fbbadd8a23ca249905ae87

SHA1
366dedb6de0d3134b00b558073948ce917143a08

SHA256
77e4b8d08215e745332043f56d5d7113e0475c7f21ec5f832c633013c05f10d1

SHA512
49f59c7aaf3f276bbda3ea145631443de8a22eaf162d8419ccc3d421d30397b6260db2b48da9f6a0691b3694e285d451e2aaf1964146a9cd9fe73e520a20ed41

Download Submit
memory/2384-1266-0x000007FEF5E40000-0x000007FEF62A5000-memory.dmp

Filesize
4.4MB

Download