e6b32d507a0a5fddbf064fd372b8ff75c6929f491ed464ea6312b59f1e3fa9ea

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 19:22

Target
GunDupe v1.1-new.luac
Size 5KB
Sample260628-x3bedac18k
SHA256 e6b32d507a0a5fddbf064fd372b8ff75c6929f491ed464ea6312b59f1e3fa9ea
MD5 75f692129cb6f0c48f9ef74bdcdec52c
SHA1 fb29ec42b8596de107bf5b615b360f76c9415090
SHA512 726c2076480d27f4c22ada46b1feb701e48b887bce7bbeee3f0844cde11c8a16ac44393816faa80cde6af1de66d8a2b997b7288a03204c602e3720b10a8c8cdc
SSDEEP 96:5myDJIBgFz0MoyeiJjNEINlqrhRmw7xCx22b4HgWywoEdrPqOgOO3Gw:5myDJIyFwMoyNJFlqlxCxp4HgWFoEdrW
TLSH
T1ABC1F8F6078C5612341FE0431817EB51B120B92EA731EB2BD92DB79BA6097AD7F2424C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2128	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\GunDupe v1.1-new.luac"
1⤵
- Modifies registry class
PID:5984

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact