ab7ef836e52bda5433e014057e88a57def522ef7e225a1a406208b19ac75e9a9

Resubmissions

16-03-2024 00:38

16-03-2024 00:34

max time kernel
146s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
16-03-2024 00:38

Target

csgo-cs2-spoofer-main/Serial.Change/Spoofer.bat
Size

45KB
MD5

2f5d048f0459e679eb6d45bda12004cd
SHA1

997bb6807a737c23fa6ce9668789d932f87f486c
SHA256

01bb5217494cbaa202a7591a56c2eaf3c7e770139ca8d45373d313c8f87904e2
SHA512

a46a81b259ac35f8be5812d5c2c20e7ecb6dca91861ffbe83ecdb3ca3caadd08c835793b70fc439f3b9669300f3b617f83fdfb207327b59664af7479f063d6e0
SSDEEP

384:xefoA9SjSmLIb9a+dcJy10+D2s99VSMZ4YIYkpAlOE0P5Gw4wsID8ankvYBMxTpv:0r/iAlOVP5Gw4tVlMCAVOFJ

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1152	540	cmd.exe	82
PID 540 wrote to memory of 1152	540	cmd.exe	82
PID 540 wrote to memory of 1484	540	cmd.exe	83
PID 540 wrote to memory of 1484	540	cmd.exe	83
PID 1484 wrote to memory of 1856	1484	cmd.exe	84
PID 1484 wrote to memory of 1856	1484	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Serial.Change\Spoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Serial.Change\Spoofer.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Serial.Change\Spoofer.bat"
    3⤵
    PID:1856