a4a5d231bbf2655f226459365ddc995ed0c1f223ec1f52d5807c8c1d167e98cb

Analysis

max time kernel
25s
max time network
29s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27/06/2023, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

799fc9f4ea57a15619f8fd9ddf758950.exe
Size

703KB
MD5

799fc9f4ea57a15619f8fd9ddf758950
SHA1

b44d2bdb442811c4b4894ea4cb81a6d3a7999670
SHA256

a4a5d231bbf2655f226459365ddc995ed0c1f223ec1f52d5807c8c1d167e98cb
SHA512

1ad285fb602d88fc7e250a107618ab604b609797549d51d79ec9f538c1b971fc926ce8beee2f2029f1b7d98a6bf99ca1f729a6d5e05b45bf145e498b5b8746f9
SSDEEP

6144:5UPAUV624Zk+nC+f8Z7DgMvVXYNlV8F/2/6utZeiXhOy8oMmkCOutH5BysohXowm:5mV620nN8ZoAutZeiXhOBuOaBToG4ZY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1456	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	27
PID 1572 wrote to memory of 1456	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	27
PID 1572 wrote to memory of 1456	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	27
PID 1572 wrote to memory of 1496	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	28
PID 1572 wrote to memory of 1496	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	28
PID 1572 wrote to memory of 1496	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	28
PID 1572 wrote to memory of 1528	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	29
PID 1572 wrote to memory of 1528	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	29
PID 1572 wrote to memory of 1528	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	29
PID 1572 wrote to memory of 1416	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	30
PID 1572 wrote to memory of 1416	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	30
PID 1572 wrote to memory of 1416	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	30
PID 1572 wrote to memory of 1640	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	31
PID 1572 wrote to memory of 1640	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	31
PID 1572 wrote to memory of 1640	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	31
PID 1572 wrote to memory of 1252	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	32
PID 1572 wrote to memory of 1252	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	32
PID 1572 wrote to memory of 1252	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	32
PID 1572 wrote to memory of 912	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	33
PID 1572 wrote to memory of 912	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	33
PID 1572 wrote to memory of 912	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	33
PID 1572 wrote to memory of 612	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	34
PID 1572 wrote to memory of 612	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	34
PID 1572 wrote to memory of 612	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	34
PID 1572 wrote to memory of 1680	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	35
PID 1572 wrote to memory of 1680	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	35
PID 1572 wrote to memory of 1680	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	35
PID 1572 wrote to memory of 320	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	36
PID 1572 wrote to memory of 320	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	36
PID 1572 wrote to memory of 320	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	36
PID 1572 wrote to memory of 1060	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	37
PID 1572 wrote to memory of 1060	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	37
PID 1572 wrote to memory of 1060	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	37
PID 1572 wrote to memory of 1400	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	38
PID 1572 wrote to memory of 1400	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	38
PID 1572 wrote to memory of 1400	1572	799fc9f4ea57a15619f8fd9ddf758950.exe	38

C:\Users\Admin\AppData\Local\Temp\799fc9f4ea57a15619f8fd9ddf758950.exe
"C:\Users\Admin\AppData\Local\Temp\799fc9f4ea57a15619f8fd9ddf758950.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Windows Activation Fix
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0b
  2⤵
  PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo This tool will fix your Windows Activation
  2⤵
  PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:1640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Made by skidaim#0607
  2⤵
  PID:612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1400

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads