7b9723c3ca58ecdde9af2dd2215e00fa7c7692e960242d9c6b2e80ab45fc90d5

Analysis

max time kernel
83s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2023 23:34

Target

Activation.exe
Size

703KB
MD5

8c1d40db6464fd098716a317486db961
SHA1

4b4d82e0a91f11e1348488b9e9edd43697d9db67
SHA256

7b9723c3ca58ecdde9af2dd2215e00fa7c7692e960242d9c6b2e80ab45fc90d5
SHA512

16c868e227c4928dfcc116ba6e9d93c22418936cad625cd48645abb96229d31ee1329105097d2e7f36f6382e214dfd54e1eb92842bcc45edd978f64da6c4c6dd
SSDEEP

6144:5UPAUV624Zk+nC+f8Z7DgMvVXYNlV8F/2/6utZeiXhOy8oMmkCOutH5BysohXWwm:5mV620nN8ZoAutZeiXhOBuOaBToo4ZY

Score

1^/10

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Activation.exe

description	pid	process	target process
PID 4164 wrote to memory of 828	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 828	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1888	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1888	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1920	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1920	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 556	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 556	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 636	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 636	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 972	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 972	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1804	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1804	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1664	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1664	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1980	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 1980	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 3088	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 3088	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 3172	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 3172	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 116	4164	Activation.exe	cmd.exe
PID 4164 wrote to memory of 116	4164	Activation.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Activation.exe
"C:\Users\Admin\AppData\Local\Temp\Activation.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c title Windows Activation Fix
2⤵
PID:828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c echo This tool will fix your Windows Activation
2⤵
PID:556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c echo Made by skidaim#0607
2⤵
PID:1664