a5a5aa8f693392f5c29d043b29ef156d378c612552b3f77de8181635dc0fba07

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 00:40

Target

KMSpico Install/KMSpico_setup.exe
Size

3.1MB
MD5

1a5fc26d8596c2573c7a5e480fb94724
SHA1

8360fb00b33197c5752290932f02ac618cd0b22b
SHA256

3f1ea290fba74c05430e50488a3ce7c146f7328fce21f6f41a098fd68fa09da6
SHA512

c474e6811e22a5138659d51c0498cab10327bae904dd5d90e0ce49c9f4d43575bc14692877752bef6f03442488c994e0b5ee68c96d8490c310d9add5965a06e1
SSDEEP

98304:xTuMDwQzUQ3+PeKJnjwRWZ8agvJcS2UhgXRcouzWF:LJzUFlJnNZ8RhjTWBR

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2140	KMSpico_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 2140	3136	KMSpico_setup.exe	87
PID 3136 wrote to memory of 2140	3136	KMSpico_setup.exe	87
PID 3136 wrote to memory of 2140	3136	KMSpico_setup.exe	87

C:\Users\Admin\AppData\Local\Temp\KMSpico Install\KMSpico_setup.exe
"C:\Users\Admin\AppData\Local\Temp\KMSpico Install\KMSpico_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\is-46G7E.tmp\KMSpico_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-46G7E.tmp\KMSpico_setup.tmp" /SL5="$E0064,2946007,69120,C:\Users\Admin\AppData\Local\Temp\KMSpico Install\KMSpico_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:2140

C:\Users\Admin\AppData\Local\Temp\is-46G7E.tmp\KMSpico_setup.tmp

Filesize
703KB

MD5
1778c1f66ff205875a6435a33229ab3c

SHA1
5b6189159b16c6f85feed66834af3e06c0277a19

SHA256
95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

SHA512
8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

Download Submit
memory/2140-7-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2140-13-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2140-16-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3136-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3136-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3136-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download