c215bca386adafdbad5b6d635a73e19bd0aa11dc089aa407faeba6d78aa8c1ed

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 18:23

Target

skycheatsfn.exe
Size

77.7MB
MD5

d10d31742cfcb68c942ea714970106a2
SHA1

d7fb54301153a8c201a23cc0dab66f3575a270f5
SHA256

c215bca386adafdbad5b6d635a73e19bd0aa11dc089aa407faeba6d78aa8c1ed
SHA512

77ba4aeb313d2132a1a36ff9be57aecede930ec1632572a51f1fdac19064f92910143233cc5e042199eae7eccadfa2ce1c4186eb101d70990a533331bec7a4fb
SSDEEP

1572864:KvHcRlLh7vXSk8IpG7V+VPhqWdfME7tlHegiYweyJulZUdgXUWzBrdoEGV37U:KvHcR9hTSkB05awqfLdMpuDUeBr6to

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3000	skycheatsfn.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d3c3-1273.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3000	2276	skycheatsfn.exe	30
PID 2276 wrote to memory of 3000	2276	skycheatsfn.exe	30
PID 2276 wrote to memory of 3000	2276	skycheatsfn.exe	30

C:\Users\Admin\AppData\Local\Temp\skycheatsfn.exe
"C:\Users\Admin\AppData\Local\Temp\skycheatsfn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\skycheatsfn.exe
  "C:\Users\Admin\AppData\Local\Temp\skycheatsfn.exe"
  2⤵
  - Loads dropped DLL
  PID:3000

C:\Users\Admin\AppData\Local\Temp\_MEI22762\python312.dll

Filesize
1.7MB

MD5
36e9be7e881d1dc29295bf7599490241

SHA1
5b6746aedac80f0e6f16fc88136bcdcbd64b3c65

SHA256
ebef43e92267a17f44876c702c914aafa46b997b63223ff46b12149fd2a2616e

SHA512
090d4e9092b7fe00180164b6f84b4bd1d1a1e12dc8fea042eaa0e75cc08bb9994c91c3853bedec390208db4ef2e3447cd9be20d7dc20c14e6deb52a141d554cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22762\wheel-0.43.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
memory/3000-1275-0x000007FEF5730000-0x000007FEF5DF5000-memory.dmp

Filesize
6.8MB

Download