9ce3cf905e87f0ce69beb15338cebbce751e1a3ce498f51fef5fb5b071391a5c

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 13:42

Target

Orbit Unknowncheats.exe
Size

2.3MB
MD5

debfed81575b081b3096cf0cc1d6fe5d
SHA1

465fed4b590b663f513e1ce59f8b0ca0d288a65a
SHA256

ae2d4dbd8d30b986ae605c80c86a49980fe496c7666158ac71efd596971447b1
SHA512

b2b5bdd3bf2408a5cc938201665bdb07ec796edc015736e9ba856ebe629e46d6721656a298efa4e336215f7b38e12a63d7a2a40a8c061f39041d508cace89232
SSDEEP

49152:xa6dFn9L290dDk5igVo45c6uKYyKIH7KS70tlpQBcrP2/4Dj5v7bQ8:fdJ9Lu9Imoyc6uKYyKIH7KSI3uB2

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 456	1556	Orbit Unknowncheats.exe	84
PID 1556 wrote to memory of 456	1556	Orbit Unknowncheats.exe	84
PID 456 wrote to memory of 468	456	cmd.exe	85
PID 456 wrote to memory of 468	456	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\Orbit Unknowncheats.exe
"C:\Users\Admin\AppData\Local\Temp\Orbit Unknowncheats.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tar --version >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\system32\tar.exe
    tar --version
    3⤵
    PID:468