ee1810583b7d5c9951398c7677224d57fc3bec3396d2267e793cd7de6a6bbe7b

Analysis

max time kernel
65s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2023 17:55

Target

SotExternalESPv3.5.4_unknowncheats.me_.exe
Size

396KB
MD5

7e64f6cc9b065155a1852582a39c5738
SHA1

95d511c5da410faff55de5ba08425b5f31733a1a
SHA256

ee1810583b7d5c9951398c7677224d57fc3bec3396d2267e793cd7de6a6bbe7b
SHA512

ad945f10a50e1f2ddfef39d4225cf81a2eb808f80df94f0c3bf5a94d624126a460b2b476f88cf11f6e4dae7ec95a1d5b48d1b6c11692ca8d3966b5860b629e92
SSDEEP

12288:wUJu0SUsSl6xlVBl5vIN+zjWufPR427XU3zO/j1mWdQgMYPGzT0sh+1TAcflmmBa:wUTsW6jVT5vIN+zjWufPR427XU3zO/jY

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	SotExternalESPv3.5.4_unknowncheats.me_.exe
2992	SotExternalESPv3.5.4_unknowncheats.me_.exe

C:\Users\Admin\AppData\Local\Temp\SotExternalESPv3.5.4_unknowncheats.me_.exe
"C:\Users\Admin\AppData\Local\Temp\SotExternalESPv3.5.4_unknowncheats.me_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4340