91d02c64d50ccfec6e524bfd1aed912fd98de32af9433e39c85c37e8a8916f80

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:30

Target

Activador Office 2010 Toolkit 2.0 Beta 4/Office 2010 Toolkit.exe
Size

15.2MB
MD5

a83be61814daac34542680f84448edb5
SHA1

56e4531e58a508b45c43a813dc4da578db231886
SHA256

a5a5e3c8319c187fc75e9b1893ed30103d4b139435f015913a25aaae6abf5722
SHA512

65ad346aaca1189f6d7ee5e473127b4643d646f07f0819ea9ca358bde1e2179277f47d3244e5776d9f76a4eda3c1f1a13fe33ba08cd91e6226572283d78c40c8
SSDEEP

49152:QW8rJ52GKwhWpKMglhWpbpe0A7NC4952GfSX1UFqQmNeLa1o3kYQHjOCAJ/Lsb6p:QW8hjyN2UxAJDh3F

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2728	1580	Office 2010 Toolkit.exe	31
PID 1580 wrote to memory of 2728	1580	Office 2010 Toolkit.exe	31
PID 1580 wrote to memory of 2728	1580	Office 2010 Toolkit.exe	31

C:\Users\Admin\AppData\Local\Temp\Activador Office 2010 Toolkit 2.0 Beta 4\Office 2010 Toolkit.exe
"C:\Users\Admin\AppData\Local\Temp\Activador Office 2010 Toolkit 2.0 Beta 4\Office 2010 Toolkit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 856
  2⤵
  PID:2728

memory/1580-0-0x000007FEF666E000-0x000007FEF666F000-memory.dmp

Filesize
4KB

Download
memory/1580-2-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/1580-1-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/1580-3-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/1580-5-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/1580-6-0x000007FEF666E000-0x000007FEF666F000-memory.dmp

Filesize
4KB

Download
memory/1580-7-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-4-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download