Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CS2纯透视注入器.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
CS2纯透视注入器.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target CS2纯透视注入器.exe
- Size 503KB
- Sample260417-bps7dagt5s
- SHA256 26be13b6798dc50c6dd01a5265e174610fe5136f6cf4fb6e2431780a1b3085e5
- MD5 232b028b31eba72949e29db55d563cd7
- SHA1 8e20a4d054e88f8954c98a9092652a036d350ebb
- SHA512 04353906496a12c58d541c7b5553bfd68dc9f5c3c4cdb438d0a0c36d4b34df32338a45365dd876c94927387f710c3fe30b2700386b686eee17d4ae3943b2e95b
- SSDEEP 12288:cMcoHMe9WMNY5wsSWAKQMmUyJ+xKwY5wsSWAKQMmUyJ+xK:pcosqrNRsrAKQMmDJ+xKwRsrAKQMmDJp
- TLSH T14AB45A01A3E851E9C0ABC0FC9657A802FBB130455320E7CF67518A597FAB9F42A7FB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe 1920 CS2纯透视注入器.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1920 wrote to memory of 5260 1920 CS2纯透视注入器.exe 80 PID 5260 wrote to memory of 4772 5260 cmd.exe 81 PID 1920 wrote to memory of 3116 1920 CS2纯透视注入器.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\CS2纯透视注入器.exe"C:\Users\Admin\AppData\Local\Temp\CS2纯透视注入器.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp 650012⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:4772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:3116
-