39065b8e50d19765161479a1be084e17b47f40bc9dd55fb35aa66d168483f117

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 02:53

Target

SkinChanger_Valorant-SkinChanger/hookloader.exe
Size

14KB
MD5

c7911519fb673c84f34367595ca3959e
SHA1

c4e69b84653a9dcd366b7b856ea645bc909c3cc7
SHA256

2bc9149ceaff9f9b92bbb087a8eebfa16f34157396dae6b94ab6fba8d825aadb
SHA512

d3447d6860defb120dc85c735144e09437c1400a907e98039d4aa2c0990e9311f00f8ea3597e6bec7dc6c2da050da697e26d2fdfdd5b0d5b10b9a617dae2ca5c
SSDEEP

192:lsAlX/bCYV9sXPQuMDeCCxBiKZV7x/6iaAws681iW5tfMcu6/:lsAlX/GYV9pTU0OVFik

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2320	2060	hookloader.exe	31
PID 2060 wrote to memory of 2320	2060	hookloader.exe	31
PID 2060 wrote to memory of 2320	2060	hookloader.exe	31

C:\Users\Admin\AppData\Local\Temp\SkinChanger_Valorant-SkinChanger\hookloader.exe
"C:\Users\Admin\AppData\Local\Temp\SkinChanger_Valorant-SkinChanger\hookloader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2320