2e8274a993b411f3e58e841d85abbaefa921e06ab596d05331fdd640fc701887

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:18

Target
Drunken Dream Driver Cheat Engine/򲻿Ա.bat
Size 30B
Sample260804-pgldfswves
SHA256 2e8274a993b411f3e58e841d85abbaefa921e06ab596d05331fdd640fc701887
MD5 87065777dd386748c6a67bf23f6287fe
SHA1 ed8869e91ee818c1c7544613e8ba3849eca17c33
SHA512 bdc06a54b1fc080c8de299d4b479d36d44f345d28336f6821e4278df59b8d60b0408b63e768279ba734673e8feeb68fd00fe460b29698b1cfff9e0e401aaa7d3
MD5 SHA1 SHA512

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4932	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
2580	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4932	2580	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Drunken Dream Driver Cheat Engine\򲻿Ա.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\sc.exe
  sc delete DrunkenDreamDriver
  2⤵
  - Launches sc.exe
  PID:4932