fd88ca3df8d66708e121b661fc3028fd0dfc275e88c64b8ed34b0b9b9c04b6d2

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:32

Target

Activator/KMSAuto/KMSAuto - Windows & Office Activator.lnk
Size

1KB
MD5

a797ceb9770c3d36d23c8f16dc46a108
SHA1

e46acc5ded3f8c121c424a4644f1f80359ca529f
SHA256

25967436570d5aea257ee268b86eda2cfcf3a698a5bdcf09a0cb903d9aa3aea2
SHA512

427aa1d5c83b21ea3a0c9694d0ed3fa96e933fa4f28b65cfd3e5c1775d0d900b7556c3571683aa025eb701d0607b117292b4a37becf96f4a80171b28cd53b5db

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2112	KMSAUTO.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2112	2620	cmd.exe	29
PID 2620 wrote to memory of 2112	2620	cmd.exe	29
PID 2620 wrote to memory of 2112	2620	cmd.exe	29
PID 2620 wrote to memory of 2112	2620	cmd.exe	29
PID 2112 wrote to memory of 2632	2112	KMSAUTO.EXE	30
PID 2112 wrote to memory of 2632	2112	KMSAUTO.EXE	30
PID 2112 wrote to memory of 2632	2112	KMSAUTO.EXE	30
PID 2112 wrote to memory of 2632	2112	KMSAUTO.EXE	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Activator\KMSAuto\KMSAuto - Windows & Office Activator.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\Activator\KMSAuto\KMSAUTO.EXE
  C:\Users\Admin\AppData\Local\Temp\Activator\KMSAuto\KMSAuto - Windows
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
    3⤵
    PID:2632