c29379ad77c234ec161faa837487b6dea9dbd14ce6294e1d0b6878a576ae7f58

Analysis

max time kernel
140s
max time network
139s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 16:04

Target

Nurik 1.16.5 crack/CrackLauncher.exe
Size

101KB
MD5

8af6fddaaaa1e49fd726f573fe69fba7
SHA1

ccc52eb5c92fb85a8df177ffb467fe9aba2a0cb6
SHA256

69623ca675497a9bf5b703eaf88d1067704ae004ff16df2e6a26214138776f4b
SHA512

a0a47ed93a00e5849b5a99e520c39db4efeca7e0e8699e2aa27efebbc000ed908a6c776289c5ae1636157cd91d4b41cefa7ea1a954fb224466d94d88c8e9b5f5
SSDEEP

1536:MV14sMWfg1AKdTiBjAORN38A/Hdwoja/r6sXxqW4kEEv:u4NWfg1AKdajAOr8A/9wo+/rmW4kEE

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\shell\open\command	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\shell\open	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\DefaultIcon	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nurik 1.16.5 crack\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\shell	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nurik 1.16.5 crack\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol"	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\discord-1199748644409184347\URL Protocol	CrackLauncher.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2788	2356	CrackLauncher.exe	29
PID 2356 wrote to memory of 2788	2356	CrackLauncher.exe	29
PID 2356 wrote to memory of 2788	2356	CrackLauncher.exe	29

C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\CrackLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\CrackLauncher.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2788