282d2b794167f4fd91c6a126595d73c09221025a4994b57bd0fe101ac0ceae82

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crackme.exe
Size 801KB
Sample260802-wbhtpsde25
SHA256 282d2b794167f4fd91c6a126595d73c09221025a4994b57bd0fe101ac0ceae82
MD5 832a290716427023f2c081cbfc9fc66e
SHA1 eb1f691ec57983c9ba26928f6af8a4eeeabd4f9a
SHA512 10bc91f83ec8708f7063cbbd1c4c7b84a7ab5c160f52a243bb4468678ead98cf62284ce44851ed60a428e4833e609832e4dddcc197010791666aef456033a504
SSDEEP 12288:TnebAnN+bhuZ6CIzeCAgmPetBeK/HOCxJYaBMf0FBgJoNN+HMIfeP6gsjZJiKn:bTZ6NDdnBpJchoH+HMk+6gsjPl
TLSH
T1D6056E26BA6800FCD077D2F8CE569903E7B1B85603716ADB03E09A7A2F175E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
2316	taskkill.exe
3096	taskkill.exe
6068	taskkill.exe
5036	taskkill.exe
5660	taskkill.exe
3480	taskkill.exe
3400	taskkill.exe
3784	taskkill.exe
2928	taskkill.exe
4468	taskkill.exe
1640	taskkill.exe
4932	taskkill.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	3096	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	4932	taskkill.exe
Token: SeDebugPrivilege	3480	taskkill.exe
Token: SeDebugPrivilege	3400	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 3784	5920	Crackme.exe	90
PID 5920 wrote to memory of 2928	5920	Crackme.exe	93
PID 5920 wrote to memory of 3096	5920	Crackme.exe	96
PID 5920 wrote to memory of 4468	5920	Crackme.exe	99
PID 5920 wrote to memory of 6068	5920	Crackme.exe	101
PID 5920 wrote to memory of 5036	5920	Crackme.exe	103
PID 5920 wrote to memory of 1640	5920	Crackme.exe	105
PID 5920 wrote to memory of 5660	5920	Crackme.exe	107
PID 5920 wrote to memory of 4932	5920	Crackme.exe	109
PID 5920 wrote to memory of 3480	5920	Crackme.exe	111
PID 5920 wrote to memory of 3400	5920	Crackme.exe	113
PID 5920 wrote to memory of 2316	5920	Crackme.exe	115

C:\Users\Admin\AppData\Local\Temp\Crackme.exe
"C:\Users\Admin\AppData\Local\Temp\Crackme.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientServices.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientUx.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientUxRender.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "RiotClientCrashHandler.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueClient.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueClientUx.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueClientUxRender.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueCrashHandler.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5660
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "LeagueCrashHandler64.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "VALORANT.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "VALORANT-Win64-Shipping.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3400
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM "vgc.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2316

C:\Users\Admin\AppData\Local\Temp\Crackme.exe
"C:\Users\Admin\AppData\Local\Temp\Crackme.exe" --svc
1⤵
PID:6108

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads