b0ed771e6f1fad2f9bd04fa5a749131149e9116dd7c99becc04c23391b9ff690

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:58

Target
DesignBuilder.v2.2.4.001-RECOiL/crack/License_Server/service_stop.cmd
Size 57B
Sample240603-scgfgsbd99
SHA256 4b2c3fa1cee839d482ad7389b9d206c12213df78e474c64974680cd41d2fd183
MD5 dbb932ddefe79a1400313e6293190c86
SHA1 d383308c53f935a7db5a312917acb5df401f3230
SHA512 0e06bf54eb2cd3364637d73a950956d83a04f06ceb9a1076be751da1dd56c6ffd1c19893c0ab3a69cc20f8f393efd9997a302eec9ccb5b489fef7999a4c1163c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3548	3772	cmd.exe	84
PID 3772 wrote to memory of 3548	3772	cmd.exe	84
PID 3548 wrote to memory of 4700	3548	net.exe	85
PID 3548 wrote to memory of 4700	3548	net.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\service_stop.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\system32\net.exe
  net stop "DesignBuilder License Server"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "DesignBuilder License Server"
    3⤵
    PID:4700