fd88ca3df8d66708e121b661fc3028fd0dfc275e88c64b8ed34b0b9b9c04b6d2

Analysis

max time kernel
142s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:32

Target

Activator/KMSAuto/KMSAuto - Windows & Office Activator.lnk
Size

1KB
MD5

a797ceb9770c3d36d23c8f16dc46a108
SHA1

e46acc5ded3f8c121c424a4644f1f80359ca529f
SHA256

25967436570d5aea257ee268b86eda2cfcf3a698a5bdcf09a0cb903d9aa3aea2
SHA512

427aa1d5c83b21ea3a0c9694d0ed3fa96e933fa4f28b65cfd3e5c1775d0d900b7556c3571683aa025eb701d0607b117292b4a37becf96f4a80171b28cd53b5db

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 5088	3308	cmd.exe	88
PID 3308 wrote to memory of 5088	3308	cmd.exe	88
PID 3308 wrote to memory of 5088	3308	cmd.exe	88
PID 5088 wrote to memory of 1080	5088	KMSAUTO.EXE	90
PID 5088 wrote to memory of 1080	5088	KMSAUTO.EXE	90

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Activator\KMSAuto\KMSAuto - Windows & Office Activator.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\Activator\KMSAuto\KMSAUTO.EXE
  C:\Users\Admin\AppData\Local\Temp\Activator\KMSAuto\KMSAuto - Windows
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
    3⤵
    PID:1080