5e7fddd0c419cb08413dd353e5986e9e41663be8ff382e1665fa20eeccf97b60

Analysis

max time kernel
40s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 05:22

Target

????(?????????????,??????????).exe
Size

805KB
MD5

63126cbceb38700ed8d8b95a88bc88ee
SHA1

776f02c82ed0a814e5a342fd2ab38d206ba9afcb
SHA256

da9503e27cddce64c271b6c94d6c37f8996db7cc938eefd42f36b06bc0d9597f
SHA512

37c2d7a17c1ba82f40baca0f5372a9996f530beb5a7b614480ff812d900b541ed05c109022f25f4ab6a49d5e92b8fd6aac4068e95c6f1fb2a92526e19f132dc2
SSDEEP

3072:1+JZ/FdHbd4wYeOsK9i7AROnMVE/GpYT0WyvStvStvStvStvStvSRigj+sBouJuG:qfclvsvsvsvsvsvOigguJutvXM

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microkms.txt	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2156	2044	____(_____________,__________).exe	93
PID 2044 wrote to memory of 2156	2044	____(_____________,__________).exe	93
PID 2156 wrote to memory of 1684	2156	cmd.exe	95
PID 2156 wrote to memory of 1684	2156	cmd.exe	95
PID 2156 wrote to memory of 3136	2156	cmd.exe	97
PID 2156 wrote to memory of 3136	2156	cmd.exe	97
PID 2156 wrote to memory of 5000	2156	cmd.exe	98
PID 2156 wrote to memory of 5000	2156	cmd.exe	98
PID 2156 wrote to memory of 1864	2156	cmd.exe	100
PID 2156 wrote to memory of 1864	2156	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\____(_____________,__________).exe
"C:\Users\Admin\AppData\Local\Temp\____(_____________,__________).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\System32\slmgr.vbs /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
    3⤵
    PID:1684
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\System32\slmgr.vbs /skms de4dot.microkms.com
    3⤵
    PID:3136
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\System32\slmgr.vbs /ato
    3⤵
    PID:5000
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\System32\slmgr.vbs /ckms
    3⤵
    PID:1864

C:\Windows\microkms.txt

Filesize
233B

MD5
dc2cd350c834d52c099400961245f32e

SHA1
5f604ff279a48488fcd3d4677547573f1fc6340f

SHA256
cc44e2ae2daaf3ea247e2decd3db11ddce70a317d915efa9bbd34f4cd1b4dfdb

SHA512
3d71437942418e16f0f96d4706bd3bc9f2e1640c17ad0e33c7e19eb88ade3b3c8578dffd1eb70b4ef5bd524c04559d5df1a7e50301314330cc0ded7c7fddaac6

Download Submit
memory/2044-133-0x0000000000B70000-0x0000000000C3E000-memory.dmp

Filesize
824KB

Download
memory/2044-134-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download
memory/2044-135-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download
memory/2044-136-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download
memory/2044-137-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download
memory/2044-140-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download