07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:59

Target

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe
Size

736KB
MD5

cd2e6fe9b61979274b3d54f479344c66
SHA1

80dcc6c709c3bd3fe67674a8c8ad1c93b4049638
SHA256

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a
SHA512

6f71942c720b155724b99e4d0fd2861c9edfae6a3d520aa0ab40bedaffdb244eba717be0814606e5e84a9f2bfdfe4c68a228fe4a32a4859d577997e19fe59843
SSDEEP

12288:/npaODJZfcaxqAiRr0C4AnQocURS3ZPY+X9NQGuXip:/jqAiBlQoSRvuX4

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

~GMB942.exe

pid process

4364 ~GMB942.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

description pid process

Token: SeDebugPrivilege 2680 07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

pid	process
4364	~GMB942.exe

description	pid	process
Token: SeDebugPrivilege	2680	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe

description	pid	process	target process
PID 2680 wrote to memory of 4364	2680	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe	~GMB942.exe
PID 2680 wrote to memory of 4364	2680	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe	~GMB942.exe
PID 2680 wrote to memory of 4364	2680	07a892775b5edfcc1a6227d8ae37067b0333039b623b93ba1228368bcab3119a.exe	~GMB942.exe

C:\Users\Admin\AppData\Local\Temp\~GMB942.exe
"C:\Users\Admin\AppData\Local\Temp\~GMB942.exe"
2⤵
- Executes dropped EXE
PID:4364

C:\Users\Admin\AppData\Local\Temp\~GMB942.exe

Filesize
444KB

MD5
ce70d88ffd6a2a22b1ca32adc0f66d60

SHA1
0c2f9a073da47b56bac0232300004f80c457fc7c

SHA256
911dc4f717042bed0e2b90eb2b0ce0b1aa864f76cd8255027c6676046ba475fa

SHA512
8e3cf3ffae40702f59f2634a381ac3a5d02c3319a6c26c31e3b425847ee747cba6236a7a3fb3e3a2d07208d7b11ec15a2b197d0814d79a3f57ee20516cce40f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~GMB942.exe

Filesize
444KB

MD5
ce70d88ffd6a2a22b1ca32adc0f66d60

SHA1
0c2f9a073da47b56bac0232300004f80c457fc7c

SHA256
911dc4f717042bed0e2b90eb2b0ce0b1aa864f76cd8255027c6676046ba475fa

SHA512
8e3cf3ffae40702f59f2634a381ac3a5d02c3319a6c26c31e3b425847ee747cba6236a7a3fb3e3a2d07208d7b11ec15a2b197d0814d79a3f57ee20516cce40f2

Download Submit
memory/4364-133-0x0000000000000000-mapping.dmp

Download