20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e

Analysis

max time kernel
152s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:41

Target

20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e.exe
Size

707KB
MD5

6cdfdb974af0dfa2794910d79aa9e9b7
SHA1

594a24828d4a516ae40330abf9b0a0d1f6fbf360
SHA256

20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e
SHA512

cb1075022069d5329da91de727d44ddf3deb3e8fe21570c55e944d47b4a22517b721375057caf95f31f4a3e522dc656e099974b416af7b1c662d425f83c07025
SSDEEP

12288:8npaODJZfcaxqAiRTfZXPxYZ6kREv6PtfNhv0SwXN:8jqAi5NZkRESASQ

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1556	~GME0CF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1556	4980	20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e.exe	82
PID 4980 wrote to memory of 1556	4980	20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e.exe	82
PID 4980 wrote to memory of 1556	4980	20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e.exe	82

C:\Users\Admin\AppData\Local\Temp\20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e.exe
"C:\Users\Admin\AppData\Local\Temp\20b50c11532916d7cb3fcfe099aa4c88cea2736a02d54a274ece23a18831156e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\~GME0CF.exe
  "C:\Users\Admin\AppData\Local\Temp\~GME0CF.exe"
  2⤵
  - Executes dropped EXE
  PID:1556

C:\Users\Admin\AppData\Local\Temp\~GME0CF.exe

Filesize
410KB

MD5
04c3a905bcf011dfa1123f4f89d22897

SHA1
e542e5ab109c8a10f8dd003871be6aac56571455

SHA256
65f07493fb67d75dcc4ce67c4e1dc87cbe8a7ce5bccdb6e4b1bbab65fb800d18

SHA512
06b78df69433776fe3ec855cf0370d086e75a3aea0741ad2d1069feec9ff9cfc920486788b69aaa707746077e61b15ac3f2b8bd611bc09fa464eccd288befe71

Download Submit
C:\Users\Admin\AppData\Local\Temp\~GME0CF.exe

Filesize
410KB

MD5
04c3a905bcf011dfa1123f4f89d22897

SHA1
e542e5ab109c8a10f8dd003871be6aac56571455

SHA256
65f07493fb67d75dcc4ce67c4e1dc87cbe8a7ce5bccdb6e4b1bbab65fb800d18

SHA512
06b78df69433776fe3ec855cf0370d086e75a3aea0741ad2d1069feec9ff9cfc920486788b69aaa707746077e61b15ac3f2b8bd611bc09fa464eccd288befe71

Download Submit