b913899afa3741ed46315f6c1491e5777a3c1cf46a1d05a433af0d74ecb66cba

Analysis

max time kernel
144s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
06-07-2024 13:55

Target

Apex-CV-YOLO-v8-Aim-Assist-Bot-main/addenv.cmd
Size

772B
MD5

775c55817fd3d3ec4a885cda2eb62c54
SHA1

ca786f4e2cde7401fbda4af19bd02aed203712b7
SHA256

adac1687583835074455d4c5aa54ee8317da9af17d18eb3874000a0f4ceab979
SHA512

fbea0a8bffc9bc6ea4e2b1fc0be962f4f50c094f5bbc2c55e89a38c0b6fda3ceb439cb4f7ab1893e09dbca1a6fc0c6e3a9dc63e986f7b7e23cf65265caf47739

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 8	2428	cmd.exe	79
PID 2428 wrote to memory of 8	2428	cmd.exe	79
PID 8 wrote to memory of 4620	8	cmd.exe	80
PID 8 wrote to memory of 4620	8	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Apex-CV-YOLO-v8-Aim-Assist-Bot-main\addenv.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\reg.exe query "HKCU\Environment" /v "Path" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query "HKCU\Environment" /v "Path"
    3⤵
    PID:4620