Analysis
- max time kernel
52s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/05/2026, 04:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lustful Spirit Hunt Ver0.3.4/Lustful Spirit Hunt.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target Lustful Spirit Hunt Ver0.3.4/Lustful Spirit Hunt.exe
- Size 638KB
- Sample260508-e24qescz7s
- SHA256 865d34051507dc99b39b7ac439db40560858ccc4bf6704d6a7fb9dad5b60d253
- MD5 dc438e7eba92b28eaac58d30258b1990
- SHA1 75ec1ac1e956935db2467db1d9538536af7aaba9
- SHA512 c0a4b10f001f018347d4cdabdd991e1d11f76cccb6e051c3f5459dd5e5a610804004333d272a3b8d98cb18b34547ca65c8dd4acd6d277980b1277d7e27d668f1
- SSDEEP 6144:IpC62lkCTM33UbIcGAy99IVaRrvvCSPyrSpRGvKE4oZwwbkJyeT5:I4eCOGkIVqESpRBE4xJyC
- TLSH T11DD4627D7F971F95E7C914717A5DE6299698833CB093823EB72AC447DC20EA43C80AD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1548 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1548 AUDIODG.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5036 Lustful Spirit Hunt.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5036 wrote to memory of 1484 5036 Lustful Spirit Hunt.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lustful Spirit Hunt Ver0.3.4\Lustful Spirit Hunt.exe"C:\Users\Admin\AppData\Local\Temp\Lustful Spirit Hunt Ver0.3.4\Lustful Spirit Hunt.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\Lustful Spirit Hunt Ver0.3.4\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\Lustful Spirit Hunt Ver0.3.4\UnityCrashHandler64.exe" --attach 5036 22331991695362⤵PID:1484
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548