c29379ad77c234ec161faa837487b6dea9dbd14ce6294e1d0b6878a576ae7f58

Analysis

max time kernel
142s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 16:04

Target

Nurik 1.16.5 crack/CrackLauncher.exe
Size

101KB
MD5

8af6fddaaaa1e49fd726f573fe69fba7
SHA1

ccc52eb5c92fb85a8df177ffb467fe9aba2a0cb6
SHA256

69623ca675497a9bf5b703eaf88d1067704ae004ff16df2e6a26214138776f4b
SHA512

a0a47ed93a00e5849b5a99e520c39db4efeca7e0e8699e2aa27efebbc000ed908a6c776289c5ae1636157cd91d4b41cefa7ea1a954fb224466d94d88c8e9b5f5
SSDEEP

1536:MV14sMWfg1AKdTiBjAORN38A/Hdwoja/r6sXxqW4kEEv:u4NWfg1AKdajAOr8A/9wo+/rmW4kEE

Score

1^/10

Modifies registry class 9 IoCs

Processes:

CrackLauncher.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol"	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\URL Protocol	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell\open\command	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell\open	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nurik 1.16.5 crack\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\DefaultIcon	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nurik 1.16.5 crack\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell	CrackLauncher.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

CrackLauncher.exe

description	pid	process	target process
PID 768 wrote to memory of 4380	768	CrackLauncher.exe	cmd.exe
PID 768 wrote to memory of 4380	768	CrackLauncher.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\CrackLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\CrackLauncher.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4380