282d2b794167f4fd91c6a126595d73c09221025a4994b57bd0fe101ac0ceae82

Analysis

user interaction
yes
max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crackme.exe
Size 801KB
Sample260802-wbhtpsde25
SHA256 282d2b794167f4fd91c6a126595d73c09221025a4994b57bd0fe101ac0ceae82
MD5 832a290716427023f2c081cbfc9fc66e
SHA1 eb1f691ec57983c9ba26928f6af8a4eeeabd4f9a
SHA512 10bc91f83ec8708f7063cbbd1c4c7b84a7ab5c160f52a243bb4468678ead98cf62284ce44851ed60a428e4833e609832e4dddcc197010791666aef456033a504
SSDEEP 12288:TnebAnN+bhuZ6CIzeCAgmPetBeK/HOCxJYaBMf0FBgJoNN+HMIfeP6gsjZJiKn:bTZ6NDdnBpJchoH+HMk+6gsjPl
TLSH
T1D6056E26BA6800FCD077D2F8CE569903E7B1B85603716ADB03E09A7A2F175E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
1808	taskkill.exe
1076	taskkill.exe
224	taskkill.exe
4784	taskkill.exe
4648	taskkill.exe
4036	taskkill.exe
4936	taskkill.exe
1284	taskkill.exe
3748	taskkill.exe
3832	taskkill.exe
1128	taskkill.exe
1868	taskkill.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	taskkill.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	3748	taskkill.exe
Token: SeDebugPrivilege	224	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1868	4916	Crackme.exe	89
PID 4916 wrote to memory of 4936	4916	Crackme.exe	92
PID 4916 wrote to memory of 1808	4916	Crackme.exe	94
PID 4916 wrote to memory of 1284	4916	Crackme.exe	96
PID 4916 wrote to memory of 1076	4916	Crackme.exe	98
PID 4916 wrote to memory of 3748	4916	Crackme.exe	101
PID 4916 wrote to memory of 224	4916	Crackme.exe	104
PID 4916 wrote to memory of 4784	4916	Crackme.exe	106
PID 4916 wrote to memory of 3832	4916	Crackme.exe	108
PID 4916 wrote to memory of 4648	4916	Crackme.exe	110
PID 4916 wrote to memory of 4036	4916	Crackme.exe	112
PID 4916 wrote to memory of 1128	4916	Crackme.exe	114

C:\Users\Admin\AppData\Local\Temp\Crackme.exe
"C:\Users\Admin\AppData\Local\Temp\Crackme.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientServices.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientUx.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientUxRender.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientCrashHandler.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueClient.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueClientUx.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueClientUxRender.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueCrashHandler.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueCrashHandler64.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "VALORANT.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "VALORANT-Win64-Shipping.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "vgc.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1128

C:\Users\Admin\AppData\Local\Temp\Crackme.exe
"C:\Users\Admin\AppData\Local\Temp\Crackme.exe" --svc
1⤵
PID:1044

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads