b0ed771e6f1fad2f9bd04fa5a749131149e9116dd7c99becc04c23391b9ff690 | Triage™

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DesignBuilder.v2.2.4.001-RECOiL/crack/License_Server/service_start.cmd
Size 58B
Sample240603-scgfgsbd99
SHA256 0b9bd025f0614f315349ed069d43e50e26be245a3266f9d861dc1029fe1055ae
MD5 e1f54e83bc7bc6a5db2058f38d794063
SHA1 53e2e533249e7486d2764843e35a4e0ce19393ee
SHA512 7012ad07df3a9c20518679d7a99b4a56b560d364bd4f775d80fff982ee6ccd7d1420187ae857d0e19cb9d65d96bdc0232032aa02256ae8dbe649ee3acf9c3ddd
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1824	2852	cmd.exe	29
PID 2852 wrote to memory of 1824	2852	cmd.exe	29
PID 2852 wrote to memory of 1824	2852	cmd.exe	29
PID 1824 wrote to memory of 2012	1824	net.exe	30
PID 1824 wrote to memory of 2012	1824	net.exe	30
PID 1824 wrote to memory of 2012	1824	net.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\service_start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\net.exe
  net start "DesignBuilder License Server"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start "DesignBuilder License Server"
    3⤵
    PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads