554bac01cb52d0f45e180d85fb70d3400f28117cac892884be86468ca845dae9

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 18:36

Target

Valorant-Unlocker-main/start.bat
Size

1KB
MD5

2dd6c3ebd46dfb5a2bf4cdedfd459666
SHA1

95085e0647a4b29536306c5dc728bcf63db71fac
SHA256

9c10dcd8edcdf7a127b382ae54aafec9179249125d83e2f6266cdba4d762755f
SHA512

40ffa836559dd2872ddf6d70380be3376146bb2e00dc705028b5eaef8ab909f791c863bd21877f07c88f7ec5f3bfb2f5f5c92b323b7ac0acac910f53e0c89b56

Score

1^/10

Delays execution with timeout.exe 6 IoCs

evasion

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2908	4532	cmd.exe	97
PID 4532 wrote to memory of 2908	4532	cmd.exe	97
PID 4532 wrote to memory of 436	4532	cmd.exe	99
PID 4532 wrote to memory of 436	4532	cmd.exe	99
PID 4532 wrote to memory of 2192	4532	cmd.exe	100
PID 4532 wrote to memory of 2192	4532	cmd.exe	100
PID 4532 wrote to memory of 3724	4532	cmd.exe	101
PID 4532 wrote to memory of 3724	4532	cmd.exe	101
PID 4532 wrote to memory of 3532	4532	cmd.exe	102
PID 4532 wrote to memory of 3532	4532	cmd.exe	102
PID 4532 wrote to memory of 764	4532	cmd.exe	103
PID 4532 wrote to memory of 764	4532	cmd.exe	103
PID 4532 wrote to memory of 2212	4532	cmd.exe	106
PID 4532 wrote to memory of 2212	4532	cmd.exe	106
PID 4532 wrote to memory of 3952	4532	cmd.exe	107
PID 4532 wrote to memory of 3952	4532	cmd.exe	107

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Valorant-Unlocker-main\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2908
- C:\Windows\system32\mode.com
  mode con: cols=109 lines=26
  2⤵
  PID:436
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2192
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3724
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:3532
- C:\Windows\system32\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:764
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2212
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612