3c328e9f25a277e022237b0d45d18479fa5db72c4031cc0135cb33f57e3121b2

Analysis

max time kernel
21s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 19:22

Target

CrazySploit.zip
Size

8.2MB
MD5

6851b0717dfdac6d04d5fd2acc026092
SHA1

88da1a3ae244d261959aa239de99ee39c4c96482
SHA256

3c328e9f25a277e022237b0d45d18479fa5db72c4031cc0135cb33f57e3121b2
SHA512

69f604f87080eb2407d7b6b628191005ed0ad17fd4dd769367ebb9170dd4bf1e3da5f1b8ced31919df628e10f66e2056fd57404f9926dfd0d822c7e2d630802d
SSDEEP

196608:DqSM6An/yKmxkGXMcmzlf1DplqChiHbdkdVt:DqZhayGX4fdC5kt

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
1728	CrazySploit.exe
2616	CrazySploit.exe

Loads dropped DLL 12 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	7zFM.exe
2496	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2496	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of FindShellTrayWindow 4 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1728	2496	7zFM.exe	30
PID 2496 wrote to memory of 1728	2496	7zFM.exe	30
PID 2496 wrote to memory of 1728	2496	7zFM.exe	30
PID 1728 wrote to memory of 1044	1728	CrazySploit.exe	31
PID 1728 wrote to memory of 1044	1728	CrazySploit.exe	31
PID 1728 wrote to memory of 1044	1728	CrazySploit.exe	31
PID 2496 wrote to memory of 2616	2496	7zFM.exe	33
PID 2496 wrote to memory of 2616	2496	7zFM.exe	33
PID 2496 wrote to memory of 2616	2496	7zFM.exe	33
PID 2616 wrote to memory of 484	2616	CrazySploit.exe	34
PID 2616 wrote to memory of 484	2616	CrazySploit.exe	34
PID 2616 wrote to memory of 484	2616	CrazySploit.exe	34

C:\Users\Admin\AppData\Local\Temp\7zO0C98E296\CrazySploit.exe

Filesize
111KB

MD5
fac0416670ee810931a717d98e1fbba1

SHA1
610329b747fed064e226a09f853a4d98d2fc3b7a

SHA256
1c00136793f09fd4b75b5ae077bcf4e220873cbbc1a650cf4eb88f9f2da0f2f8

SHA512
2110468425f9488fd276aab48960dd7746c95b0b8ee47db29ec6c975f1b9cfdde5c19e80dd69c6d9f8039bae1f1eaeb1794e69600d9ddbd43b8fb934dab0e364

Download Submit
memory/1728-160-0x000000013FC00000-0x000000013FC20000-memory.dmp

Filesize
128KB

Download
memory/2616-174-0x000000013FD10000-0x000000013FD30000-memory.dmp

Filesize
128KB

Download