2c94796c6ad4d1ed123194d787fa91f728d28a9ac5f455e59219ee097d49fdfa

Resubmissions

01/05/2024, 17:15

240501-vshplaeb67 7

01/05/2024, 17:06

01/05/2024, 17:01

01/05/2024, 17:00

01/05/2024, 16:59

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240419-de
resource tags

arch:x64arch:x86image:win7-20240419-delocale:de-deos:windows7-x64systemwindows
submitted
01/05/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AmongUs-Cheat.exe
Size

16.1MB
MD5

a40bc37eff26c03a52f137813410b276
SHA1

f0736be3bd4151705becbb75a2dfbdeb39eb64f3
SHA256

2c94796c6ad4d1ed123194d787fa91f728d28a9ac5f455e59219ee097d49fdfa
SHA512

d18a8407f47f7b7decfe46fe50b70844ea470976b1c92b8a134aae3764f9ec18931ffb7dbf9de7b5a1bdeff3bfac697336e23b366b19ff7807dd02b036d58234
SSDEEP

393216:Ev90+5gDkTh2Jp5MwurEUWjsrz7E5PKk9buK+x:i9PvThidb8z7bkEK+

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2948	AmongUs-Cheat.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001962f-91.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2948	1728	AmongUs-Cheat.exe	28
PID 1728 wrote to memory of 2948	1728	AmongUs-Cheat.exe	28
PID 1728 wrote to memory of 2948	1728	AmongUs-Cheat.exe	28

C:\Users\Admin\AppData\Local\Temp\AmongUs-Cheat.exe
"C:\Users\Admin\AppData\Local\Temp\AmongUs-Cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\AmongUs-Cheat.exe
  "C:\Users\Admin\AppData\Local\Temp\AmongUs-Cheat.exe"
  2⤵
  - Loads dropped DLL
  PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI17282\python312.dll

Filesize
1.7MB

MD5
8f9e3a154ef42634941f6b8b0e7596d5

SHA1
bf6a86ed4fe5ef5cd6fa3481a57415abd7d89fa1

SHA256
cc947a9fcd6d569d60960758a6226e27dfe9ed8ca2cec3105ae99a711b1be3a9

SHA512
42c2a57324c32fdf00ed671c8efe419e4dcb3842f630a2fddc9714285c27a6ca5d9e065ea31e0a7a5834cc8c78855984627891dc376a637815ac27f0cdcee519

Download Submit
memory/2948-93-0x000007FEF5E50000-0x000007FEF6515000-memory.dmp

Filesize
6.8MB

Download