Analysis
-
max time kernel
453s -
max time network
1176s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-05-2024 18:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CrackLauncher.exe
Resource
win11-20240426-en
windows11-21h2-x64
3 signatures
1800 seconds
General
-
Target
CrackLauncher.exe
-
Size
5.5MB
-
MD5
52aaa8c3fd6b813b713ae05ab9e4829c
-
SHA1
d4ac8addbe5e15e867afe58f4bbb8319395ad38e
-
SHA256
0c30d4cb510304d4ce140952f8ce316056cc4bc552cef78a81fd5301aecc1fd2
-
SHA512
c39bba95a8554f1115d0362bad33901fd87e00d5de7671cd48d7b537c97889882b9009a83948087cf8516a32588e4ef831531977740b17a2791cec927934fdd8
-
SSDEEP
98304:SJuJhPWclzxum6p/GuTIZULvC6LcbE6HGek94x1RK22cJfcdnidC7GpWhGrj6j:QuaAxSTZLvD6/x1R92cJUMo7xS6
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3568 CrackLauncher.exe 3568 CrackLauncher.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3568 CrackLauncher.exe 3568 CrackLauncher.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3568 wrote to memory of 4860 3568 CrackLauncher.exe 77 PID 3568 wrote to memory of 4860 3568 CrackLauncher.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4860
-