ab7ef836e52bda5433e014057e88a57def522ef7e225a1a406208b19ac75e9a9

Resubmissions

16-03-2024 00:38

16-03-2024 00:34

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 00:34

Target

csgo-cs2-spoofer-main/Serial.Change/Spoofer.bat
Size

45KB
MD5

2f5d048f0459e679eb6d45bda12004cd
SHA1

997bb6807a737c23fa6ce9668789d932f87f486c
SHA256

01bb5217494cbaa202a7591a56c2eaf3c7e770139ca8d45373d313c8f87904e2
SHA512

a46a81b259ac35f8be5812d5c2c20e7ecb6dca91861ffbe83ecdb3ca3caadd08c835793b70fc439f3b9669300f3b617f83fdfb207327b59664af7479f063d6e0
SSDEEP

384:xefoA9SjSmLIb9a+dcJy10+D2s99VSMZ4YIYkpAlOE0P5Gw4wsID8ankvYBMxTpv:0r/iAlOVP5Gw4tVlMCAVOFJ

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1704	3960	cmd.exe	89
PID 3960 wrote to memory of 1704	3960	cmd.exe	89
PID 3960 wrote to memory of 1624	3960	cmd.exe	90
PID 3960 wrote to memory of 1624	3960	cmd.exe	90
PID 1624 wrote to memory of 1284	1624	cmd.exe	92
PID 1624 wrote to memory of 1284	1624	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Serial.Change\Spoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Serial.Change\Spoofer.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Serial.Change\Spoofer.bat"
    3⤵
    PID:1284