8d5d35f9076e11fa22c9a8f90f336af8c3d659440b22fa1b464d6d536ced4bae

Analysis

max time kernel
3s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 19:57

Target

PasswordChanger EXE/Cracked.exe
Size

10.4MB
MD5

2f16b61dd6e04c42696a65d571170cf1
SHA1

d91bd5a6fe70503d971c54d4d8874956f382c8f9
SHA256

9612bab8cd82ccaf623b299cab96991f613baca04969ec561212e7b47a564f9a
SHA512

2141cb1bf6fd592364b5ac5e3d02d3d8c02c92cf5d63f1f91beff011ebb6affd3b248b0c67c55b15f4dac010193277ab41464091513b8b4c778697cf6ed31cbc
SSDEEP

98304:cHUqECew1y/T2W+z4jQXYc201gjhzQJ9BE/4dea4WL2uwvd:U1y/TfLcn1gtEJ9C/Sqd

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1916	4868	Cracked.exe	84
PID 4868 wrote to memory of 1916	4868	Cracked.exe	84
PID 4868 wrote to memory of 4948	4868	Cracked.exe	85
PID 4868 wrote to memory of 4948	4868	Cracked.exe	85

C:\Users\Admin\AppData\Local\Temp\PasswordChanger EXE\Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\PasswordChanger EXE\Cracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\cmd.exe
  cmd /c cls||clear
  2⤵
  PID:1916
- C:\Windows\system32\cmd.exe
  cmd /c cls||clear
  2⤵
  PID:4948