07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:59

Target

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe
Size

736KB
MD5

cd2e6fe9b61979274b3d54f479344c66
SHA1

80dcc6c709c3bd3fe67674a8c8ad1c93b4049638
SHA256

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a
SHA512

6f71942c720b155724b99e4d0fd2861c9edfae6a3d520aa0ab40bedaffdb244eba717be0814606e5e84a9f2bfdfe4c68a228fe4a32a4859d577997e19fe59843
SSDEEP

12288:/npaODJZfcaxqAiRr0C4AnQocURS3ZPY+X9NQGuXip:/jqAiBlQoSRvuX4

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

~GMF4CB.exe

pid process

1692 ~GMF4CB.exe

pid	process
1692	~GMF4CB.exe

Loads dropped DLL 2 IoCs

Processes:

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

pid	process
1768	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe
1768	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

description pid process

Token: SeDebugPrivilege 1768 07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

description	pid	process
Token: SeDebugPrivilege	1768	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

description	pid	process	target process
PID 1768 wrote to memory of 1692	1768	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe	~GMF4CB.exe
PID 1768 wrote to memory of 1692	1768	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe	~GMF4CB.exe
PID 1768 wrote to memory of 1692	1768	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe	~GMF4CB.exe
PID 1768 wrote to memory of 1692	1768	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe	~GMF4CB.exe

C:\Users\Admin\AppData\Local\Temp\~GMF4CB.exe
"C:\Users\Admin\AppData\Local\Temp\~GMF4CB.exe"
2⤵
- Executes dropped EXE
PID:1692

C:\Users\Admin\AppData\Local\Temp\~GMF4CB.exe

Filesize
444KB

MD5
ce70d88ffd6a2a22b1ca32adc0f66d60

SHA1
0c2f9a073da47b56bac0232300004f80c457fc7c

SHA256
911dc4f717042bed0e2b90eb2b0ce0b1aa864f76cd8255027c6676046ba475fa

SHA512
8e3cf3ffae40702f59f2634a381ac3a5d02c3319a6c26c31e3b425847ee747cba6236a7a3fb3e3a2d07208d7b11ec15a2b197d0814d79a3f57ee20516cce40f2

Download Submit
\Users\Admin\AppData\Local\Temp\~GMF4CB.exe

Filesize
444KB

MD5
ce70d88ffd6a2a22b1ca32adc0f66d60

SHA1
0c2f9a073da47b56bac0232300004f80c457fc7c

SHA256
911dc4f717042bed0e2b90eb2b0ce0b1aa864f76cd8255027c6676046ba475fa

SHA512
8e3cf3ffae40702f59f2634a381ac3a5d02c3319a6c26c31e3b425847ee747cba6236a7a3fb3e3a2d07208d7b11ec15a2b197d0814d79a3f57ee20516cce40f2

Download Submit
\Users\Admin\AppData\Local\Temp\~GMF4CB.exe

Filesize
444KB

MD5
ce70d88ffd6a2a22b1ca32adc0f66d60

SHA1
0c2f9a073da47b56bac0232300004f80c457fc7c

SHA256
911dc4f717042bed0e2b90eb2b0ce0b1aa864f76cd8255027c6676046ba475fa

SHA512
8e3cf3ffae40702f59f2634a381ac3a5d02c3319a6c26c31e3b425847ee747cba6236a7a3fb3e3a2d07208d7b11ec15a2b197d0814d79a3f57ee20516cce40f2

Download Submit
memory/1692-57-0x0000000000000000-mapping.dmp

Download
memory/1768-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download