31e7adc340e1aa4ed0832a1af7e0bc1e7ba60b143bad25f409d628d3846f5991 | Triage

Resubmissions

20/01/2025, 20:03

250120-ysq8hswrdv 3

01/05/2024, 09:44

240501-lqwc8sca5t 3

01/05/2024, 09:43

240501-lpwydaeb46 3

01/05/2024, 09:40

240501-lncs4sea98 3

01/05/2024, 09:38

240501-lmc3gsea79 3

Analysis

max time kernel
78s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 09:38

Sharing

Report Analysis Logs

General

Target

CheatHunter 0.32 x64.exe
Size

688KB
MD5

eb54e974824aa6ad19f3f46613f149e3
SHA1

830d84bbb704ba6a0ee3ff803b490e0d119fe1cf
SHA256

31e7adc340e1aa4ed0832a1af7e0bc1e7ba60b143bad25f409d628d3846f5991
SHA512

da593f0d6ad13b97bf80fc03102d77f7aece76c79c02bba884018ede0bf52b4ac6125faef50519e1cdbe195b9bc004fd3b7895756413b13f86f605db4bfe6a55
SSDEEP

12288:FkiXwouRx3n8grcZVd68DxZK/9S0Lib1:FkiGP3nbGVd6MbK/j

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1516	4952	CheatHunter 0.32 x64.exe	94
PID 4952 wrote to memory of 1516	4952	CheatHunter 0.32 x64.exe	94

C:\Users\Admin\AppData\Local\Temp\CheatHunter 0.32 x64.exe
"C:\Users\Admin\AppData\Local\Temp\CheatHunter 0.32 x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PAUSE
  2⤵
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads