b0f676f29e958a2b569442e554b8798dd0f74cbe6379c3ef8e95e7320ab54606

Analysis

max time kernel
21s
max time network
31s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 06:08

Target

Electric Shock Academy/Electric Shock Academy - DL Site.exe
Size

638KB
MD5

2d99ed0fdf705fa9b3bf1e293d419411
SHA1

d463e1b4d1355e36c4dfc943cde43d352287a69c
SHA256

20a4d9125d9cbe5194b987f8580d952b4f195109bedbe0074b5500aca567457b
SHA512

7ef703b8c650ae286ed0fe055fe453361065dba4afbd6bbad1a84f2cac0bb04fe9ac503908816a9f3e13b43c3ef34dce703a8023350f4822f7aab52afaba6a8c
SSDEEP

6144:8EbaWnBUCGmGPk5qxicCuGwIu0ceUim/3tLiBqGaME6jnZO6NUvvCu8w44:8oCCJRcLIu3iBXnZNQMk

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	Electric Shock Academy - DL Site.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1800	1716	Electric Shock Academy - DL Site.exe	31
PID 1716 wrote to memory of 1800	1716	Electric Shock Academy - DL Site.exe	31
PID 1716 wrote to memory of 1800	1716	Electric Shock Academy - DL Site.exe	31

C:\Users\Admin\AppData\Local\Temp\Electric Shock Academy\Electric Shock Academy - DL Site.exe
"C:\Users\Admin\AppData\Local\Temp\Electric Shock Academy\Electric Shock Academy - DL Site.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\Electric Shock Academy\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\Electric Shock Academy\UnityCrashHandler64.exe" --attach 1716 659456
  2⤵
  PID:1800

memory/1716-13-0x000007FFFFEC0000-0x000007FFFFED0000-memory.dmp

Filesize
64KB

Download
memory/1716-26-0x000007FFFFEB0000-0x000007FFFFEC0000-memory.dmp

Filesize
64KB

Download