ba96005634873047b9ada6154758b4f81c4a41c6767fd79bf264fc050fb98fae

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 21:54

Target

Sharingan_Cracked.exe
Size

67KB
MD5

c909cd9e22da2b708cc925224a9dfd2b
SHA1

df258ca6fdf82e8bf49c6b36b14e5e12a25230e3
SHA256

ba96005634873047b9ada6154758b4f81c4a41c6767fd79bf264fc050fb98fae
SHA512

aaf8788f0eb0a5919f166ba8915001ffd669f2db58bb20218389f79bf6f755638122df55cfc573cdb70f649504d84fb47281fc732614dba48cb9c30407e23db3
SSDEEP

1536:3oZnaQ/rMve7yIWsGq1a1husII5q90RaQgHNQEcfvvb1Zm1/3Yzjmhc+t7etk383:3oZnaQ/rMve7yIWsGq1a1husII5q90RZ

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2924	1588	Sharingan_Cracked.exe	85
PID 1588 wrote to memory of 2924	1588	Sharingan_Cracked.exe	85
PID 2924 wrote to memory of 4368	2924	cmd.exe	86
PID 2924 wrote to memory of 4368	2924	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\Sharingan_Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Sharingan_Cracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=80 lines=25
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\mode.com
    mode con cols=80 lines=25
    3⤵
    PID:4368