ea62b044689bb6d2f747e17637ad24347a2a0a75364dfc72d6927f5e43e42b54

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 18:21

Target

crack.exe
Size

3.4MB
MD5

a827295f4df3c5ba4eae2c68b555ab18
SHA1

04a24b11e1eaa40d221ae960160dfb4bd39effbd
SHA256

f801b0b197f0b4b3244441aa7428acf34c2a034201a00d8d4d8eab0d3b647908
SHA512

8a53a730bc1bd78b1f108fe1e22d03dbb9f6802092ec31291befedcac7016b3ddc37206b2fca72dafc20d4cb83c5fd68d39cb38f6b69c18a4df10285e6dfc1d0
SSDEEP

49152:S6D0LjBn8/PkyiZYq6cVERznwOnqswS/KtJ78JEmm8PKXnqrADkMT0IZdC:y/VeJwYUQXqpAVmmm8PwntT0IZdC

Score

1^/10

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 4192	3672	crack.exe	88
PID 3672 wrote to memory of 4192	3672	crack.exe	88
PID 4192 wrote to memory of 2260	4192	cmd.exe	89
PID 4192 wrote to memory of 2260	4192	cmd.exe	89
PID 3672 wrote to memory of 4796	3672	crack.exe	90
PID 3672 wrote to memory of 4796	3672	crack.exe	90

C:\Users\Admin\AppData\Local\Temp\crack.exe
"C:\Users\Admin\AppData\Local\Temp\crack.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start CompPkgSrv.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\CompPkgSrv.exe
    CompPkgSrv.exe
    3⤵
    PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4796

memory/3672-0-0x00007FF94B0F0000-0x00007FF94B2E5000-memory.dmp

Filesize
2.0MB

Download
memory/3672-1-0x00007FF94B0E0000-0x00007FF94B0E1000-memory.dmp

Filesize
4KB

Download
memory/3672-2-0x0000000000700000-0x0000000000732000-memory.dmp

Filesize
200KB

Download
memory/3672-3-0x00007FF94B0F0000-0x00007FF94B2E5000-memory.dmp

Filesize
2.0MB

Download
memory/3672-4-0x0000000000700000-0x0000000000732000-memory.dmp

Filesize
200KB

Download