c964a5cb43bb94dbdc0daea574856cc3d944a5cbaecd63c8f7ba1f8a9a8d910a

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/11/2026, 22:31

Target
Tovek-V2.7-windows-x86_64/luau-lifter.exe
Size 10.7MB
Sample261102-2fkrraxtdx
SHA256 c964a5cb43bb94dbdc0daea574856cc3d944a5cbaecd63c8f7ba1f8a9a8d910a
MD5 a68b1f59d4b381e418e157ee9b541213
SHA1 d81878cd117a75cd82932f76bb7f75f886d6defe
SHA512 6d33854b95f5ec8aa3445547c2f327000dc393439f94828c2dffddda3bb4122124b835c0f0ab6cb74cbc67c2d4bdacc88eb089ea91cb3a0d213868b47c300c5e
SSDEEP 98304:yEIXwtjxCafkY1RQgvJlJspydC3KMbtuXH9fol1ILCDTTLgA:kOjfjHXJeKfp
TLSH
T185B63A157A5F68ACD15AC870834A8A631A2134DB1B36BCFF40D492352FAEFB05B3D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4412	4140	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Tovek-V2.7-windows-x86_64\luau-lifter.exe
"C:\Users\Admin\AppData\Local\Temp\Tovek-V2.7-windows-x86_64\luau-lifter.exe"
1⤵
PID:1200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\Tovek-V2.7-windows-x86_64\luau-lifter.exe
  luau-lifter
  2⤵
  PID:4412