1cfa528f681554c587934f4302e9b0a9151022696686a10b81cbef68d3558e71

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2023, 16:10

Target

WALLHACK.exe
Size

22KB
MD5

a083a8b1429c8b2118e6b0bb89ffcc0c
SHA1

4c0c0032dd9d3588ce38e4d54bf22b23bcbccf90
SHA256

1cfa528f681554c587934f4302e9b0a9151022696686a10b81cbef68d3558e71
SHA512

29b3123613a668191699795f0b812b39ce95830a50b662d1a8a507ad1704b558b52e351ba7d233f7ff61bd1654234ebf210d894580e4f3a097238a3d8d9294fd
SSDEEP

384:MXfuVTCXALJNT4NbkXwTOMxVZOa/OyD1yDJtjSuhT77Ow7q6OQkYTkdT:xTCXYJovTOwVZOa/XDChJ77OcbOfYTkd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
656	WALLHACK.exe
656	WALLHACK.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1776	656	WALLHACK.exe	84
PID 656 wrote to memory of 1776	656	WALLHACK.exe	84
PID 656 wrote to memory of 1776	656	WALLHACK.exe	84

C:\Users\Admin\AppData\Local\Temp\WALLHACK.exe
"C:\Users\Admin\AppData\Local\Temp\WALLHACK.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1776