b0ed771e6f1fad2f9bd04fa5a749131149e9116dd7c99becc04c23391b9ff690

Analysis

max time kernel
123s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 14:58

Target
DesignBuilder.v2.2.4.001-RECOiL/crack/License_Server/rlm.exe
Size 1.4MB
Sample240603-scgfgsbd99
SHA256 8e8f2d696c1d7e0f59f7675f98c4a7a3216215f94a956fe231df42ba1851e063
MD5 9b4a2dfbfde0bd60fbfb848592c77be2
SHA1 56df8e88297317ad497a0cbcaf99083a6f2b639b
SHA512 1a8ad841b3d59b1ef7eb2af9d6c5a9902c67dc53f4d11afd992625658a6dcd766a212937d9ba175080a3d549946f5d8ae9fa0437cda62175bfd1de3b961307bb
SSDEEP 24576:vSbyjfgELhSffd/RdHCrCODMHPcAuU+1FmQS/byuSBl09bzUiBMVm54+u:aig3d5sUPcAupmQS+p2bz8m5b
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2584	2556	rlm.exe	29
PID 2556 wrote to memory of 2584	2556	rlm.exe	29
PID 2556 wrote to memory of 2584	2556	rlm.exe	29
PID 2556 wrote to memory of 2584	2556	rlm.exe	29

C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
"C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
  "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe" -g designb "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb.set" -s 464 -p "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server" (null) (null) (null)
  2⤵
  PID:2584