52311bb93549afa22033947907157c3cfaf62df20a63ca2fbe8de9b4a66741d4

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-02-2025 04:08

Target

Spoofer (untested).exe
Size

24.5MB
MD5

fc028c5f1a875995dbdd5b2893e9822f
SHA1

3346c5180cff457c73c432ff016f15c045c17551
SHA256

52311bb93549afa22033947907157c3cfaf62df20a63ca2fbe8de9b4a66741d4
SHA512

e01413a31798aa9c2c61126501aef6e6d5413915cea59a4414be52c9f86cc9c71ccd3f99356c693b21056cab842055db27077b7fcf5cc14335e925686bf2c02e
SSDEEP

393216:262L62LqCeYw5OtW8avSiIZA0dfY8so9L/gmiVOdlVJIe:jowIW8cqflsoN/FRlVWe

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1976	Spoofer (untested).exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00030000000208f9-1098.dat	upx
behavioral1/memory/1976-1100-0x000007FEF6450000-0x000007FEF6AB4000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	Spoofer (untested).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1976	2356	Spoofer (untested).exe	31
PID 2356 wrote to memory of 1976	2356	Spoofer (untested).exe	31
PID 2356 wrote to memory of 1976	2356	Spoofer (untested).exe	31

C:\Users\Admin\AppData\Local\Temp\Spoofer (untested).exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer (untested).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\Spoofer (untested).exe
  "C:\Users\Admin\AppData\Local\Temp\Spoofer (untested).exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1976

C:\Users\Admin\AppData\Local\Temp\_MEI23562\python313.dll

Filesize
1.8MB

MD5
6b3a16dc31065257b7845d9ff611e3c6

SHA1
8cf971ee772193a93e49f4701f817bc6245cf81c

SHA256
3cdc6a436aa16671deb975af8290654a134bb916299677a08438fc7e91e6f7e6

SHA512
1d219471032c882b2e624ec1df951f6a59ee8ba39459d8eb917aaeec6899d0af6782580a5dc43ed1bbe852587c52bea32ba93ea195940335e2a19cc120c53aec

Download Submit
memory/1976-1100-0x000007FEF6450000-0x000007FEF6AB4000-memory.dmp

Filesize
6.4MB

Download
memory/1976-1101-0x000007FEF6450000-0x000007FEF6AB4000-memory.dmp

Filesize
6.4MB

Download