b0ed771e6f1fad2f9bd04fa5a749131149e9116dd7c99becc04c23391b9ff690

Analysis

max time kernel
125s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 14:58

Target
DesignBuilder.v2.2.4.001-RECOiL/crack/License_Server/service_install.cmd
Size 164B
Sample240603-scgfgsbd99
SHA256 2110cd2c6d9b3912b4353955a46dfff1b102f0f41cd2a4470af0ffc5f6fb4365
MD5 0b97239199cba939d1297974af462096
SHA1 fd051f89ed271427c7408b31d41aca540cac79dc
SHA512 b7d0fb545a3d014cab8f0d123c53b44f36fc835eb6a5c093409a270cf126583ff27afdbbb4a13847e25d195e70473c8dee7425bbda8fa783e2e37fe3a0fc2302
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
528	rlm.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 528	2140	cmd.exe	29
PID 2140 wrote to memory of 528	2140	cmd.exe	29
PID 2140 wrote to memory of 528	2140	cmd.exe	29
PID 2140 wrote to memory of 528	2140	cmd.exe	29
PID 2140 wrote to memory of 668	2140	cmd.exe	30
PID 2140 wrote to memory of 668	2140	cmd.exe	30
PID 2140 wrote to memory of 668	2140	cmd.exe	30
PID 668 wrote to memory of 476	668	net.exe	31
PID 668 wrote to memory of 476	668	net.exe	31
PID 668 wrote to memory of 476	668	net.exe	31
PID 784 wrote to memory of 1736	784	rlm.exe	33
PID 784 wrote to memory of 1736	784	rlm.exe	33
PID 784 wrote to memory of 1736	784	rlm.exe	33
PID 784 wrote to memory of 1736	784	rlm.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\service_install.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
  rlm -install_service -dlog "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb_rlm.log" -service_name "DesignBuilder License Server" -c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:528
- C:\Windows\system32\net.exe
  net start "DesignBuilder License Server"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start "DesignBuilder License Server"
    3⤵
    PID:476

C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe "-dlog" "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb_rlm.log" "-c" "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server" -service
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe
  "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\rlm.exe" -g designb "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb.set" -s 504 -p "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server" -dlog "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\designb_rlm.log" (null)
  2⤵
  PID:1736