b1011a92f0c763f1a55975f853e1ec68f2d74514df6b1858c3ea7c994d8bdb82

Resubmissions

10/07/2026, 00:15

10/07/2026, 00:12

10/07/2026, 00:11

user interaction
yes
max time kernel
24s
max time network
14s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 00:15

Target
CrytalTempCracked.exe
Size 1.0MB
Sample260710-ajyn8scv21
SHA256 b1011a92f0c763f1a55975f853e1ec68f2d74514df6b1858c3ea7c994d8bdb82
MD5 3bfcf3f9ad3c0ab57e1f7b5875f6c3eb
SHA1 505f34642d30e28a0d4ab25cf2ddccbd5d8efb90
SHA512 776e431497341199c625646f26e72e7f13709d8f7e6f5f9cf5470e84e6e903d68e4920bc904066436b3ca41d82a2e46fcd182866a396672893f0c6241fa8a084
SSDEEP 24576:p0sBpxxpwjJYZ6S/6alOjYDE/dMgAG//U6X8OgIb40N6TVxbz:p0sBvxpwCPpOhLAG//U6X8OgIbdN6bb
TLSH
T132358D5A67B801E9D1BBD17CC6678607E7B270491330ABDF02E086A51F13BE16B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3296	2536	CrytalTempCracked.exe	82
PID 3296 wrote to memory of 1880	3296	cmd.exe	83
PID 3296 wrote to memory of 1412	3296	cmd.exe	84
PID 3296 wrote to memory of 1288	3296	cmd.exe	85
PID 2536 wrote to memory of 1004	2536	CrytalTempCracked.exe	86
PID 2536 wrote to memory of 2052	2536	CrytalTempCracked.exe	87
PID 2536 wrote to memory of 3980	2536	CrytalTempCracked.exe	88
PID 2536 wrote to memory of 2332	2536	CrytalTempCracked.exe	89

C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe
"C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5
    3⤵
    PID:1880
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1412
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2332