554bac01cb52d0f45e180d85fb70d3400f28117cac892884be86468ca845dae9

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 18:36

Target

Valorant-Unlocker-main/start.bat
Size

1KB
MD5

2dd6c3ebd46dfb5a2bf4cdedfd459666
SHA1

95085e0647a4b29536306c5dc728bcf63db71fac
SHA256

9c10dcd8edcdf7a127b382ae54aafec9179249125d83e2f6266cdba4d762755f
SHA512

40ffa836559dd2872ddf6d70380be3376146bb2e00dc705028b5eaef8ab909f791c863bd21877f07c88f7ec5f3bfb2f5f5c92b323b7ac0acac910f53e0c89b56

Score

1^/10

Delays execution with timeout.exe 6 IoCs

evasion

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2096	2692	cmd.exe	29
PID 2692 wrote to memory of 2096	2692	cmd.exe	29
PID 2692 wrote to memory of 2096	2692	cmd.exe	29
PID 2692 wrote to memory of 2992	2692	cmd.exe	30
PID 2692 wrote to memory of 2992	2692	cmd.exe	30
PID 2692 wrote to memory of 2992	2692	cmd.exe	30
PID 2692 wrote to memory of 2264	2692	cmd.exe	31
PID 2692 wrote to memory of 2264	2692	cmd.exe	31
PID 2692 wrote to memory of 2264	2692	cmd.exe	31
PID 2692 wrote to memory of 2680	2692	cmd.exe	32
PID 2692 wrote to memory of 2680	2692	cmd.exe	32
PID 2692 wrote to memory of 2680	2692	cmd.exe	32
PID 2692 wrote to memory of 2556	2692	cmd.exe	33
PID 2692 wrote to memory of 2556	2692	cmd.exe	33
PID 2692 wrote to memory of 2556	2692	cmd.exe	33
PID 2692 wrote to memory of 2512	2692	cmd.exe	34
PID 2692 wrote to memory of 2512	2692	cmd.exe	34
PID 2692 wrote to memory of 2512	2692	cmd.exe	34
PID 2692 wrote to memory of 2412	2692	cmd.exe	35
PID 2692 wrote to memory of 2412	2692	cmd.exe	35
PID 2692 wrote to memory of 2412	2692	cmd.exe	35
PID 2692 wrote to memory of 2952	2692	cmd.exe	36
PID 2692 wrote to memory of 2952	2692	cmd.exe	36
PID 2692 wrote to memory of 2952	2692	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Valorant-Unlocker-main\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2096
- C:\Windows\system32\mode.com
  mode con: cols=109 lines=26
  2⤵
  PID:2992
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2264
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:2680
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2556
- C:\Windows\system32\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:2512
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2412
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:2952