e6844ffc17b8ae0fa446c85eb2da689890f8682500766c688adeee94dcb5828c

Analysis

max time kernel
298s
max time network
292s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 15:56

Target
DiscordQuestHelper.exe
Size 3.1MB
Sample260705-tdv6psdv91
SHA256 e6844ffc17b8ae0fa446c85eb2da689890f8682500766c688adeee94dcb5828c
MD5 ca727aeba90ba5c2f7fcba02b59c6938
SHA1 52c3d84d496005abf70da1f335ad117834d15dcb
SHA512 c6f264617d91c4137a02cd0befda24ee6d69033fe3a1407c0f0750e7b40bd88c732edea72283637b04963d5936acceb5ae3142f54c9739e783275b860b595b41
SSDEEP 49152:PUKKc4XcOVjYKlsYzjJLmqb+w+4Ss8JeUUIkR:ctXcgL56s8JeUUIkR
TLSH
T1B1E5E74369DB0DE5DED677B861C71339A734FD758A291F2BAA08C2312D636C4AD1EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3876	4664	DiscordQuestHelper.exe	81

C:\Users\Admin\AppData\Local\Temp\DiscordQuestHelper.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordQuestHelper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3876