Analysis
-
max time kernel
7s -
max time network
5s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 10:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader-Perm_cracked (1).exe
Resource
win7-20240708-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader-Perm_cracked (1).exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
Loader-Perm_cracked (1).exe
-
Size
1.4MB
-
MD5
efacb1e93320bd7c040f0e6ca441d0b1
-
SHA1
6c2c284d18004ae770f9cac28c67803fad5c846c
-
SHA256
1227c66dd0ecd15e4a37aec1864cf9b1e4bf80edad58c6d15124d19756a94b77
-
SHA512
29c770beba6bd0b5145deaef54ea9c097c5a07baea7362ad76948af0831f0416d044b797419ae77670cfc341f54651b10fc8f982953d440a9a2b1130be4c08ea
-
SSDEEP
24576:E6qsgabtl9Z8Nx6AQ8DSoRPm/Rwn4o60OegX7Aozptl72NkoV:is9bngNzv+DenO0Ervzd2Nkw
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4464 Loader-Perm_cracked (1).exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4464 wrote to memory of 536 4464 Loader-Perm_cracked (1).exe 86 PID 4464 wrote to memory of 536 4464 Loader-Perm_cracked (1).exe 86 PID 536 wrote to memory of 4028 536 cmd.exe 88 PID 536 wrote to memory of 4028 536 cmd.exe 88 PID 536 wrote to memory of 3704 536 cmd.exe 89 PID 536 wrote to memory of 3704 536 cmd.exe 89 PID 536 wrote to memory of 3232 536 cmd.exe 90 PID 536 wrote to memory of 3232 536 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe"C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe" MD53⤵PID:4028
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:3704
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:3232
-
-