ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 00:23

Target

Crack Beast/vCRACK/CMD.bat
Size

56B
MD5

b5aa964ce2b325e57872f79d60ac51f7
SHA1

fb4d777e9c26e605ec497520bee63105d4279665
SHA256

829c02f32e7c84d2b488014b0165cb43e2c6c45fb9028cc43b9d3261976dc93b
SHA512

cac0daf9d792b64a906018ba55124c0232bb1df8a41399e382176ec51984621938c03b51aad12a9c1bacefff7753d8c67fa2f083485559af3ab73aafd98c34c2

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2736	vCRACK.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2736	vCRACK.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2736	2972	cmd.exe	29
PID 2972 wrote to memory of 2736	2972	cmd.exe	29
PID 2972 wrote to memory of 2736	2972	cmd.exe	29
PID 2972 wrote to memory of 2736	2972	cmd.exe	29
PID 2972 wrote to memory of 2504	2972	cmd.exe	30
PID 2972 wrote to memory of 2504	2972	cmd.exe	30
PID 2972 wrote to memory of 2504	2972	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\CMD.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK\vCRACK.exe
  vCRACK.exe -h
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Windows\system32\cmd.exe
  cmd.exe /K "cd /d C:\Users\Admin\AppData\Local\Temp\Crack Beast\vCRACK"
  2⤵
  PID:2504