00b8176ed414597f955681a8dfa4bb9d45e0832469fd5efe876c625e13f67b8a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 03:24

Target

FivemCheat.exe
Size

7.6MB
MD5

a48eda18e6d377aa7f61472d2522cae5
SHA1

2865a89c5492ccd1e79c75a4d44ddb0c90fe12e9
SHA256

00b8176ed414597f955681a8dfa4bb9d45e0832469fd5efe876c625e13f67b8a
SHA512

8e5131ba5a475e578966ab40a50389f086ec81850f14cb0f5be24b7e6fd6015ff346c40cf00cca25b8cec971afcfd3fcdbecc2241e52de3492f8e7b1fa91b0f1
SSDEEP

196608:K068x7lvwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAoz:Z7GIH20drLYRZjoz

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2224	FivemCheat.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a400-21.dat	upx
behavioral1/memory/2224-23-0x000007FEF6780000-0x000007FEF6DE4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2224	2860	FivemCheat.exe	31
PID 2860 wrote to memory of 2224	2860	FivemCheat.exe	31
PID 2860 wrote to memory of 2224	2860	FivemCheat.exe	31

C:\Users\Admin\AppData\Local\Temp\FivemCheat.exe
"C:\Users\Admin\AppData\Local\Temp\FivemCheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\FivemCheat.exe
  "C:\Users\Admin\AppData\Local\Temp\FivemCheat.exe"
  2⤵
  - Loads dropped DLL
  PID:2224

C:\Users\Admin\AppData\Local\Temp\_MEI28602\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
memory/2224-23-0x000007FEF6780000-0x000007FEF6DE4000-memory.dmp

Filesize
6.4MB

Download
memory/2224-44-0x000007FEF6780000-0x000007FEF6DE4000-memory.dmp

Filesize
6.4MB

Download