9b9bb4416631666372cf343f2a92b94f06a4a3f00cf1f6db30917e2e6f6a978e

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 21:41

Target
cheat/vesta.exe
Size 4.7MB
Sample261009-1jsfbst1d1
SHA256 9b9bb4416631666372cf343f2a92b94f06a4a3f00cf1f6db30917e2e6f6a978e
MD5 43df62faec84e53e9b5e2f7e0f939cc8
SHA1 0311d0067183da37ae8c8760068485bbe93b385c
SHA512 bf12265f020264629b6a4620251dffda5d4b76c9bbcb9c1347a21d4d40b09dc110d3cbe9bcea4a529a4b4a5bb98f34c138c3f478bc1dccd8805237073b5ab1e4
SSDEEP 49152:WhTKPypxi2Li0mPiJI7BZVKO7WyVnN2PbsFyi7p9lXDMKw4nD6YHNThy0TeAOo1w:WhOCLO7KbsFH19lVeAOo7/u
TLSH
T14F36AE07A2A502E8D037C178CABADA03F775385547705BEF36AC4A6A1F636E01E7B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 6084	3628	vesta.exe	87

C:\Users\Admin\AppData\Local\Temp\cheat\vesta.exe
"C:\Users\Admin\AppData\Local\Temp\cheat\vesta.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\Temp\cheat\vesta.exe
  "C:\Users\Admin\AppData\Local\Temp\cheat\vesta.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084

elevation.log

Path C:\Users\Admin\AppData\Local\Temp\vesta\elevation.log
Size 355B
SHA256 084899ec0e1db4d780c0435fdfff81e1ce58c3ee7d1dcf383890a9c7d24b7fbb
MD5 b7a788a5fb44ba028945bbba1db3945a
SHA1 92908b7e55334fc4bc01ea888833b8e191e1b07f
SHA512 8c52a97aaceb9072ccecd248f1403a7cbf90c84d0dbecf8e6ff572fa362608c0001325baf34147a2d6c6d062f4251552bdb254cfb67eabd6e0cacd63ea033a5f
TLSH
T11DE0BF560E89542BFB0F437E89CC3E9752A9384104C726D54E6E2936B69560F2C5F408
MD5 SHA1 SHA512 TLSH

Submit Download