596db0b26451c60e2e618dd98f126e3932e238baa0432867203f83df27debd03

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 00:52

Target

r7flexcrack.exe
Size

34.8MB
MD5

3c1a75b28e979cf502b92931c1673ee9
SHA1

7f7b0e1baad3278325ae9ac873c7ed656223275c
SHA256

54f1b768ab994c06d7e2fe286b828d725e47759e4251c4b488eaa6b6ac710e5b
SHA512

e283606b50606586dd3a0a87240dd34a1738f0ea39a64a8f33aad14f292eb961204024ad7160fc5bfdf158a05a25cad6c205b005417549addf2e890ac9590af9
SSDEEP

786432:uckh+w+C/tpgyVjaLYcs9dm9p22awtnKNeU9i:Z6kS7HmrvasnKMUE

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

r7flexcrack.exe

pid process

2356 r7flexcrack.exe
2356 r7flexcrack.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

r7flexcrack.exe

pid process

2356 r7flexcrack.exe

pid	process
2356	r7flexcrack.exe
2356	r7flexcrack.exe

pid	process
2356	r7flexcrack.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

r7flexcrack.execmd.exe

description	pid	process	target process
PID 2356 wrote to memory of 2760	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 2760	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 2760	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 1576	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 1576	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 1576	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 2788	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 2788	2356	r7flexcrack.exe	cmd.exe
PID 2356 wrote to memory of 2788	2356	r7flexcrack.exe	cmd.exe
PID 2788 wrote to memory of 2852	2788	cmd.exe	certutil.exe
PID 2788 wrote to memory of 2852	2788	cmd.exe	certutil.exe
PID 2788 wrote to memory of 2852	2788	cmd.exe	certutil.exe
PID 2788 wrote to memory of 2856	2788	cmd.exe	find.exe
PID 2788 wrote to memory of 2856	2788	cmd.exe	find.exe
PID 2788 wrote to memory of 2856	2788	cmd.exe	find.exe
PID 2788 wrote to memory of 2880	2788	cmd.exe	find.exe
PID 2788 wrote to memory of 2880	2788	cmd.exe	find.exe
PID 2788 wrote to memory of 2880	2788	cmd.exe	find.exe

C:\Users\Admin\AppData\Local\Temp\r7flexcrack.exe
"C:\Users\Admin\AppData\Local\Temp\r7flexcrack.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\r7flexcrack.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\r7flexcrack.exe" MD5
    3⤵
    PID:2852
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2856
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2880

memory/2356-0-0x000000013F8FE000-0x0000000140DE3000-memory.dmp

Filesize
20.9MB

Download
memory/2356-10-0x0000000077C70000-0x0000000077C72000-memory.dmp

Filesize
8KB

Download
memory/2356-8-0x0000000077C70000-0x0000000077C72000-memory.dmp

Filesize
8KB

Download
memory/2356-6-0x0000000077C70000-0x0000000077C72000-memory.dmp

Filesize
8KB

Download
memory/2356-5-0x0000000077C40000-0x0000000077C42000-memory.dmp

Filesize
8KB

Download
memory/2356-3-0x0000000077C40000-0x0000000077C42000-memory.dmp

Filesize
8KB

Download
memory/2356-1-0x0000000077C40000-0x0000000077C42000-memory.dmp

Filesize
8KB

Download
memory/2356-11-0x000000013F840000-0x00000001430AA000-memory.dmp

Filesize
56.4MB

Download
memory/2356-15-0x000000013F840000-0x00000001430AA000-memory.dmp

Filesize
56.4MB

Download
memory/2356-16-0x000000013F8FE000-0x0000000140DE3000-memory.dmp

Filesize
20.9MB

Download
memory/2356-17-0x000000013F840000-0x00000001430AA000-memory.dmp

Filesize
56.4MB

Download
memory/2356-18-0x000000013F840000-0x00000001430AA000-memory.dmp

Filesize
56.4MB

Download
memory/2356-19-0x000000013F8FE000-0x0000000140DE3000-memory.dmp

Filesize
20.9MB

Download