4421bd172168fe751aa60507317a35fccd99a67e01d669300cfd92e36acd9294

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-05-2023 18:15

Target

Activation Manager Unlocker b5.exe
Size

4.0MB
MD5

b24ac28f1879875ed24ca42bf42d8d63
SHA1

d3cac1df36d2727f1e72cbcef042afa00f804db4
SHA256

4421bd172168fe751aa60507317a35fccd99a67e01d669300cfd92e36acd9294
SHA512

18fec41d10a9a024497dbdc4db4e05206417a5683c231aab2a4a320f02747f034f955c4d82e33da7503ba4624a8bc2e90e98adc333a8c2a10317ac45135bdddb
SSDEEP

98304:ZkL1MVKkK2EoZ/iDaHlF6gDZOTZBPxF5MqR50:61MVlyD6UgD+jxzMqR50

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
928	Activation Manager Unlocker b5.tmp

Loads dropped DLL 1 IoCs

pid	Process
1952	Activation Manager Unlocker b5.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 928	1952	Activation Manager Unlocker b5.exe	28
PID 1952 wrote to memory of 928	1952	Activation Manager Unlocker b5.exe	28
PID 1952 wrote to memory of 928	1952	Activation Manager Unlocker b5.exe	28
PID 1952 wrote to memory of 928	1952	Activation Manager Unlocker b5.exe	28
PID 1952 wrote to memory of 928	1952	Activation Manager Unlocker b5.exe	28
PID 1952 wrote to memory of 928	1952	Activation Manager Unlocker b5.exe	28
PID 1952 wrote to memory of 928	1952	Activation Manager Unlocker b5.exe	28

C:\Users\Admin\AppData\Local\Temp\Activation Manager Unlocker b5.exe
"C:\Users\Admin\AppData\Local\Temp\Activation Manager Unlocker b5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\is-1ICIJ.tmp\Activation Manager Unlocker b5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1ICIJ.tmp\Activation Manager Unlocker b5.tmp" /SL5="$80022,3209045,1184768,C:\Users\Admin\AppData\Local\Temp\Activation Manager Unlocker b5.exe"
  2⤵
  - Executes dropped EXE
  PID:928

C:\Users\Admin\AppData\Local\Temp\is-1ICIJ.tmp\Activation Manager Unlocker b5.tmp

Filesize
3.4MB

MD5
44d740610fe8c43fa81a8d9efe2ccb0b

SHA1
6cece14b20a1221ad157f9079d797a895f8d38c2

SHA256
340dc6d5bee71ca4842699441889b4296be80bad4bbd34f62e011c5540e8330f

SHA512
aaf49b2956f0e07b08b8f6fd0ee502d98de556be3862db2ad1422dba2e77ed5090a19271b82bde91adae206ccf260428701682f821c57abde43e10fa1994df7e

Download Submit
\Users\Admin\AppData\Local\Temp\is-1ICIJ.tmp\Activation Manager Unlocker b5.tmp

Filesize
3.4MB

MD5
44d740610fe8c43fa81a8d9efe2ccb0b

SHA1
6cece14b20a1221ad157f9079d797a895f8d38c2

SHA256
340dc6d5bee71ca4842699441889b4296be80bad4bbd34f62e011c5540e8330f

SHA512
aaf49b2956f0e07b08b8f6fd0ee502d98de556be3862db2ad1422dba2e77ed5090a19271b82bde91adae206ccf260428701682f821c57abde43e10fa1994df7e

Download Submit
memory/928-61-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/928-62-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/1952-54-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1952-64-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download