b61fed559224dec5c55d61b344407e65bb7253586120f144a8f07db35a41383d

Analysis

max time kernel
26s
max time network
32s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 19:07

Target

CheatInjector.exe
Size

12.0MB
MD5

ffd54dd853ba501a846bcb20b8fb8a92
SHA1

167e0a2d7fcb110df4d5561cfb0aa86e67784f4e
SHA256

bc668cbc597c7b00abca9b6ead346889cee9c8de235534bff296417a077df999
SHA512

eedb05f9e7a260004a53b6196401e878c8f2d2f1c47e280dc5bbca245771417fae7ffea1201ccdf1ab56a6998e0acdf2ee7e39538ea91e056f91811e2e253f6f
SSDEEP

98304:qTTm3vPx378D4xKKpmULiOSnP7REM+aweRMEz:5Pp8D40/UuO0P7yM+M

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

CheatInjector.exe

description pid process target process

PID 5056 set thread context of 4040 5056 CheatInjector.exe BitLockerToGo.exe

description	pid	process	target process
PID 5056 set thread context of 4040	5056	CheatInjector.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

CheatInjector.exe

description	pid	process	target process
PID 5056 wrote to memory of 4040	5056	CheatInjector.exe	BitLockerToGo.exe
PID 5056 wrote to memory of 4040	5056	CheatInjector.exe	BitLockerToGo.exe
PID 5056 wrote to memory of 4040	5056	CheatInjector.exe	BitLockerToGo.exe
PID 5056 wrote to memory of 4040	5056	CheatInjector.exe	BitLockerToGo.exe
PID 5056 wrote to memory of 4040	5056	CheatInjector.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:4040

memory/4040-5-0x00000000001A0000-0x00000000001F7000-memory.dmp

Filesize
348KB

Download
memory/4040-7-0x00000000001A0000-0x00000000001F7000-memory.dmp

Filesize
348KB

Download
memory/4040-10-0x00000000001A0000-0x00000000001F7000-memory.dmp

Filesize
348KB

Download
memory/5056-2-0x00007FF798140000-0x00007FF798DB3000-memory.dmp

Filesize
12.4MB

Download
memory/5056-9-0x00007FF798140000-0x00007FF798DB3000-memory.dmp

Filesize
12.4MB

Download