36994e3ed288baed8a32757c18e12e913d5b015b64fcd000c4ceeed65ed12949

Analysis

user interaction
yes
max time kernel
100s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 16:48

Target
Kainite Cheat.exe
Size 390KB
Sample260421-vbabwsc18z
SHA256 36994e3ed288baed8a32757c18e12e913d5b015b64fcd000c4ceeed65ed12949
MD5 f120dc655ad2f60daced80f22e1de4ab
SHA1 01a7bdfd63632cc9b8ce44eee8fc5b375ba076e1
SHA512 7ba91a8d3257987a2cff20a7463c23c65592de05cf354e8b053cc1f292e83d7c9afd9a784362402833e073c400cd12c3e1b3a06a5d095848f99b4d22ca13e67b
SSDEEP 12288:55ubz2BcEebBXwqb/imjDWOCAriFno+B:5MjEyBXwqrimnWqiFno+B
TLSH
T18E84AE81F1E444F8D05B613A95AAAA1FEA39385C172089D723FC45583FE33E1A7F6712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2172	3300	Kainite Cheat.exe	81

C:\Users\Admin\AppData\Local\Temp\Kainite Cheat.exe
"C:\Users\Admin\AppData\Local\Temp\Kainite Cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c kdmapper_Release.exe driver.sys
  2⤵
  PID:2172