4f0ae314c84b9b92da8945588dad661204f0608805ed62ce1c970b700e3a0193

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:42

Target
bestfreecheeto.exe
Size 554KB
Sample260806-d9v8ksff44
SHA256 4f0ae314c84b9b92da8945588dad661204f0608805ed62ce1c970b700e3a0193
MD5 153289141ce479c480c7f1c63d1f554f
SHA1 a3748d68828ef17fa588f2cf2ea05f9a74b8438f
SHA512 24d2e86377a8c7b9c1f7aa2fe212457e6ac24f32ecf56da82cfd2306bfe9f986563faf73c27f95814c8b09b92f126209000351b7f18c0772c63438625c459c65
SSDEEP 6144:2/EBkZVKKs9JYK7YaxEtasUszgHyWfk97Hw80Yn3cgNpBDUs7ncFSQ31JWljfZXB:L7m+5lhYsgNpBeFSQlkRknrx
TLSH
T129C48D46A2E400F9E0A7D078D6A76617FA763844072496CF33E049691FA37E07F7E762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3856	bestfreecheeto.exe
3856	bestfreecheeto.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4092	3856	bestfreecheeto.exe	90

C:\Users\Admin\AppData\Local\Temp\bestfreecheeto.exe
"C:\Users\Admin\AppData\Local\Temp\bestfreecheeto.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Local\Temp\bestfreecheeto.exe
  "C:\Users\Admin\AppData\Local\Temp\bestfreecheeto.exe"
  2⤵
  PID:4092