6650dcf52e02ab0459c72bf9bdbdeaa1c3748be49c4a45d04ebb18fae16baa01

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2023, 06:58

Target

Separate-Files-Version/Activators/HWID-KMS38_Activation/KMS38_Activation.cmd
Size

40KB
MD5

74d68a7a1d6889bc6b2b8e301a56e312
SHA1

f4d1fa0d085bc17561416946ccbdaf419570b8f9
SHA256

7f1d39fb7c52d805d20aa3abd3b6a558a125c196db7b1a46c4ff4e561408b2c4
SHA512

96846710d92ebd2d2e9f913948adbac4fb63933ca2e1d1394f1c71ee446494f30bc62ee13d029a4600a388093b39b42c169b7a33d80941017d1bd6b918cef2fb
SSDEEP

768:fFYuS55nPL8mMEJyuXschD6Wghku0966HPMkk:m3ImMEzbSypHk

Score

1^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1748	3916	cmd.exe	84
PID 3916 wrote to memory of 1748	3916	cmd.exe	84
PID 3916 wrote to memory of 2108	3916	cmd.exe	85
PID 3916 wrote to memory of 2108	3916	cmd.exe	85
PID 3916 wrote to memory of 4296	3916	cmd.exe	86
PID 3916 wrote to memory of 4296	3916	cmd.exe	86
PID 3916 wrote to memory of 216	3916	cmd.exe	87
PID 3916 wrote to memory of 216	3916	cmd.exe	87
PID 216 wrote to memory of 3724	216	cmd.exe	88
PID 216 wrote to memory of 3724	216	cmd.exe	88
PID 216 wrote to memory of 4316	216	cmd.exe	89
PID 216 wrote to memory of 4316	216	cmd.exe	89
PID 3916 wrote to memory of 3612	3916	cmd.exe	90
PID 3916 wrote to memory of 3612	3916	cmd.exe	90
PID 3916 wrote to memory of 2824	3916	cmd.exe	91
PID 3916 wrote to memory of 2824	3916	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Separate-Files-Version\Activators\HWID-KMS38_Activation\KMS38_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1748
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:2108
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3724
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Separate-Files-Version\Activators\HWID-KMS38_Activation\KMS38_Activation.cmd" "
  2⤵
  PID:3612
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2824