Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/06/2026, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
source crack hotfix.rar
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
source crack hotfix/hook_dll.dll
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
source crack hotfix/launcher.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
source crack hotfix/tnameserv.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
General
- Target source crack hotfix/launcher.exe
- Size 106KB
- Sample260622-raqeyacw7n
- SHA256 393e6a80fe9507d07cb333dd80c23643d0f7d15aeb570f9214a0015e578a2113
- MD5 0d2c2c7e78c0733c0feaf837d47beb01
- SHA1 aa3810b138e5ced694039dc5a7c88dda17ca7db9
- SHA512 eed7a255e3dc32f10486ba12e678e9364540afb4f9ce77ea194c54b7adfc7ae8d342411848c74e2723e5826d9ad5d6387c1adfc54f4ffad19d82b506f4d628f2
- SSDEEP 3072:rKkKwfrGePK3ThcUiGgTS3QpHfti9zq5H:VKwjKjh0TSgpFiaH
- TLSH T15BB34A6BB2FA30F9E173833885954645D772B83557219FEF03A0429A1F276E08D39F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5356 tnameserv.exe 5356 tnameserv.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3512 wrote to memory of 5356 3512 launcher.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\source crack hotfix\launcher.exe"C:\Users\Admin\AppData\Local\Temp\source crack hotfix\launcher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\source crack hotfix\tnameserv.exe"C:\Users\Admin\AppData\Local\Temp\source crack hotfix\tnameserv.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5356
-