7b9723c3ca58ecdde9af2dd2215e00fa7c7692e960242d9c6b2e80ab45fc90d5

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 16:20

Target
Activation.exe
Size 703KB
Sample241104-ttkd5stbrp
SHA256 7b9723c3ca58ecdde9af2dd2215e00fa7c7692e960242d9c6b2e80ab45fc90d5
MD5 8c1d40db6464fd098716a317486db961
SHA1 4b4d82e0a91f11e1348488b9e9edd43697d9db67
SHA512 16c868e227c4928dfcc116ba6e9d93c22418936cad625cd48645abb96229d31ee1329105097d2e7f36f6382e214dfd54e1eb92842bcc45edd978f64da6c4c6dd
SSDEEP 6144:5UPAUV624Zk+nC+f8Z7DgMvVXYNlV8F/2/6utZeiXhOy8oMmkCOutH5BysohXWwm:5mV620nN8ZoAutZeiXhOBuOaBToo4ZY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 448	2768	Activation.exe	85
PID 2768 wrote to memory of 448	2768	Activation.exe	85
PID 2768 wrote to memory of 3936	2768	Activation.exe	86
PID 2768 wrote to memory of 3936	2768	Activation.exe	86
PID 2768 wrote to memory of 3528	2768	Activation.exe	87
PID 2768 wrote to memory of 3528	2768	Activation.exe	87
PID 2768 wrote to memory of 4980	2768	Activation.exe	88
PID 2768 wrote to memory of 4980	2768	Activation.exe	88
PID 2768 wrote to memory of 1220	2768	Activation.exe	89
PID 2768 wrote to memory of 1220	2768	Activation.exe	89
PID 2768 wrote to memory of 628	2768	Activation.exe	90
PID 2768 wrote to memory of 628	2768	Activation.exe	90
PID 2768 wrote to memory of 4936	2768	Activation.exe	91
PID 2768 wrote to memory of 4936	2768	Activation.exe	91
PID 2768 wrote to memory of 2204	2768	Activation.exe	92
PID 2768 wrote to memory of 2204	2768	Activation.exe	92
PID 2768 wrote to memory of 4448	2768	Activation.exe	93
PID 2768 wrote to memory of 4448	2768	Activation.exe	93
PID 2768 wrote to memory of 1524	2768	Activation.exe	94
PID 2768 wrote to memory of 1524	2768	Activation.exe	94
PID 2768 wrote to memory of 4484	2768	Activation.exe	95
PID 2768 wrote to memory of 4484	2768	Activation.exe	95
PID 2768 wrote to memory of 4900	2768	Activation.exe	96
PID 2768 wrote to memory of 4900	2768	Activation.exe	96

C:\Users\Admin\AppData\Local\Temp\Activation.exe
"C:\Users\Admin\AppData\Local\Temp\Activation.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Windows Activation Fix
  2⤵
  PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0b
  2⤵
  PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo This tool will fix your Windows Activation
  2⤵
  PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Made by skidaim#0607
  2⤵
  PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4900