b0ed771e6f1fad2f9bd04fa5a749131149e9116dd7c99becc04c23391b9ff690

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:58

Target
DesignBuilder.v2.2.4.001-RECOiL/crack/License_Server/service_install.cmd
Size 164B
Sample240603-scgfgsbd99
SHA256 2110cd2c6d9b3912b4353955a46dfff1b102f0f41cd2a4470af0ffc5f6fb4365
MD5 0b97239199cba939d1297974af462096
SHA1 fd051f89ed271427c7408b31d41aca540cac79dc
SHA512 b7d0fb545a3d014cab8f0d123c53b44f36fc835eb6a5c093409a270cf126583ff27afdbbb4a13847e25d195e70473c8dee7425bbda8fa783e2e37fe3a0fc2302
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3460	4676	cmd.exe	83
PID 4676 wrote to memory of 3460	4676	cmd.exe	83
PID 4676 wrote to memory of 3460	4676	cmd.exe	83
PID 4676 wrote to memory of 1096	4676	cmd.exe	84
PID 4676 wrote to memory of 1096	4676	cmd.exe	84
PID 1096 wrote to memory of 1008	1096	net.exe	85
PID 1096 wrote to memory of 1008	1096	net.exe	85
PID 232 wrote to memory of 1516	232	rlm.exe	88
PID 232 wrote to memory of 1516	232	rlm.exe	88
PID 232 wrote to memory of 1516	232	rlm.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\service_install.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
  rlm -install_service -dlog "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb_rlm.log" -service_name "DesignBuilder License Server" -c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server"
  2⤵
  PID:3460
- C:\Windows\system32\net.exe
  net start "DesignBuilder License Server"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start "DesignBuilder License Server"
    3⤵
    PID:1008

C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe "-dlog" "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb_rlm.log" "-c" "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server" -service
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
  "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe" -g designb "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb.set" -s 864 -p "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server" -dlog "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb_rlm.log" (null)
  2⤵
  PID:1516