289df940c28b79a4a7df36df211beb87fec948bd2e1096192564902e196a5499

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 11:57

Target

ExitLag-Crack-2024/ExitLag-Main/setup.bat
Size

33B
MD5

cecdbcd742db673b3e6baefb127401df
SHA1

82ac4014b27094f5376b89f1ade998e5e8e297c0
SHA256

680553b459d0e730ab9260109dfab454d34dbfcf1223cc70d6d1eefd1e578c8e
SHA512

1d06a49c616b99cc7c7e19098a76cf07f8ec62cc7085d8dc6d4976e7c17e44e27d5df4c2c8421bc4242b6f46fba63b339b097fb5018a566bfe34b23070a24b2d

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
528	ExitLag.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 544	1116	cmd.exe	29
PID 1116 wrote to memory of 544	1116	cmd.exe	29
PID 1116 wrote to memory of 544	1116	cmd.exe	29
PID 544 wrote to memory of 528	544	ExitLag.exe	30
PID 544 wrote to memory of 528	544	ExitLag.exe	30
PID 544 wrote to memory of 528	544	ExitLag.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ExitLag-Crack-2024\ExitLag-Main\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\ExitLag-Crack-2024\ExitLag-Main\ExitLag.exe
  "ExitLag.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\ExitLag-Crack-2024\ExitLag-Main\ExitLag.exe
    "ExitLag.exe"
    3⤵
    - Loads dropped DLL
    PID:528

C:\Users\Admin\AppData\Local\Temp\_MEI5442\python310.dll

Filesize
3.0MB

MD5
6a7f5188775a06d2d6b4e3454d9166f6

SHA1
ee91b2e4ad18787a9ad9588043cd5171d403c856

SHA256
98283d84a80862c0763b5ea2877d15a1a7ebc98822181df04313b6822b6f2008

SHA512
1b26fdefa2aff1f9c66cf238e822c21f29c0df52c49fafc3a2f07efe0bee27aee727f0c8e0fba8772738fc086637214e4e02ecc0bfe8107bb875f6ee2ae36f58

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI5442\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit