b249966552a1b64b965003684e6ed94fbed7b92472c4127fdf21653a84771e0a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 21:43

Target

LunarSpoofer/hwidspoof.exe
Size

14.3MB
MD5

0bab157a11bf6cb49f464f335f632114
SHA1

c3111056b6649a6c783cef6c4a7bac8beb30cb8f
SHA256

ffcc5b7fe6b090a601737ef13007714dd17af1019bbec008a3cc17714fcd3ce9
SHA512

86352eb26fed1cd80f7cf51c31688314b1da8ecd10c146c89fcd9064615cef0bf711f667c58100036106abf9a0cde2e5f540c9188a3c61353de09dd6ab3cd54f
SSDEEP

196608:Zf0sKYu/PaQ+Duvf7ndQmRJ8dA6lSuqaycBIGpEqo6hTOv+QKfwJnF7vDbrh/l56:fQPndQuslSq9RoWOv+9fgF/5spLcti

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2920	hwidspoof.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2920	2676	hwidspoof.exe	31
PID 2676 wrote to memory of 2920	2676	hwidspoof.exe	31
PID 2676 wrote to memory of 2920	2676	hwidspoof.exe	31

C:\Users\Admin\AppData\Local\Temp\LunarSpoofer\hwidspoof.exe
"C:\Users\Admin\AppData\Local\Temp\LunarSpoofer\hwidspoof.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\LunarSpoofer\hwidspoof.exe
  "C:\Users\Admin\AppData\Local\Temp\LunarSpoofer\hwidspoof.exe"
  2⤵
  - Loads dropped DLL
  PID:2920

C:\Users\Admin\AppData\Local\Temp\_MEI26762\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit