734f289e454119f1bb31e9f4963c64e5230b51264229a1832b1707b9753f276c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/02/2025, 14:59

Target
bluewing TS/valorant full.exe
Size 910KB
Sample250221-sc4wsawks7
SHA256 54abc7b31f3167221eb186cf5a1ab9dc7b4945e9da4a241b46b7fbeb932fe3c7
MD5 a4589be07699d55f1e84de98fb8e14dc
SHA1 409e3df648fcd2bd70d5569ba9e39faa4b6eefb3
SHA512 313d34b55a8ffe68c208b800f77610b1cd2740f1b56939d1b95b8793b7c643da767237649c5534ea9eb39bd60e2776c2542fb38326bd817d728d8984b8fdcda6
SSDEEP 24576:lKg+vBX4JpuCUX0Qpuvgdx/y5RL90q+wRw:z+Zupu/kqFdxENAwRw
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2112	valorant full.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral13/memory/2112-0-0x000000013FAC0000-0x000000013FCAC000-memory.dmp	upx
behavioral13/memory/2112-3-0x000000013FAC0000-0x000000013FCAC000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2112	valorant full.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2300	2112	valorant full.exe	32
PID 2112 wrote to memory of 2300	2112	valorant full.exe	32
PID 2112 wrote to memory of 2300	2112	valorant full.exe	32
PID 2300 wrote to memory of 2244	2300	cmd.exe	33
PID 2300 wrote to memory of 2244	2300	cmd.exe	33
PID 2300 wrote to memory of 2244	2300	cmd.exe	33
PID 2300 wrote to memory of 2392	2300	cmd.exe	34
PID 2300 wrote to memory of 2392	2300	cmd.exe	34
PID 2300 wrote to memory of 2392	2300	cmd.exe	34
PID 2300 wrote to memory of 552	2300	cmd.exe	35
PID 2300 wrote to memory of 552	2300	cmd.exe	35
PID 2300 wrote to memory of 552	2300	cmd.exe	35
PID 2112 wrote to memory of 1688	2112	valorant full.exe	36
PID 2112 wrote to memory of 1688	2112	valorant full.exe	36
PID 2112 wrote to memory of 1688	2112	valorant full.exe	36

C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe
"C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe" MD5
    3⤵
    PID:2244
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2392
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1688

memory/2112-0-0x000000013FAC0000-0x000000013FCAC000-memory.dmp

Download

memory/2112-3-0x000000013FAC0000-0x000000013FCAC000-memory.dmp

Download