dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144

Analysis

max time kernel
241s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 12:12

Target

dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe
Size

491KB
MD5

4172f7164a9238c340f0850f47ee9667
SHA1

6ebe1fc999b08e1df6244633e66d80c2ae9c9d5b
SHA256

dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144
SHA512

e00422c61beee00bfe2054a0533074d8cdfad8aa38a4644e79a37af4b36f332e45c867cc783543781f5dde0c96d318d452f24fbf5e169e2c11660c1fc63ad9f8
SSDEEP

12288:5npaODJZfcaxqAiRd3fPv1qPv/ydNcQvwFOHF0TR:5jqAiXdbBIFOHS

Score

8^/10

aspackv2

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

Executes dropped EXE 1 IoCs

pid	Process
1472	~GMDCC9.exe

Loads dropped DLL 2 IoCs

pid	Process
672	dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe
672	dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	672	dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 1472	672	dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe	28
PID 672 wrote to memory of 1472	672	dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe	28
PID 672 wrote to memory of 1472	672	dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe	28
PID 672 wrote to memory of 1472	672	dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe	28

C:\Users\Admin\AppData\Local\Temp\dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe
"C:\Users\Admin\AppData\Local\Temp\dabf9fb4e323a9c09edf6593c990a39a806a04a577ecab9954ff452e76f51144.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\~GMDCC9.exe
  "C:\Users\Admin\AppData\Local\Temp\~GMDCC9.exe"
  2⤵
  - Executes dropped EXE
  PID:1472

C:\Users\Admin\AppData\Local\Temp\~GMDCC9.exe

Filesize
201KB

MD5
5b73509f42f74767d622f468aeed17a9

SHA1
52096d51abd8222945e4cd11e4be2e014d61bd1a

SHA256
d563a8fd019b17290e1ef6f9046c10e562c20b9b90c51baa6a2845f160a088f9

SHA512
eefe481dfe25c4add9949f7258085066b1b8e688b07046a4e7965b682e6193fc7ee5873f3873996edb728b9ece883fd91ffdee4d10474abbefd63ae315a669f6

Download Submit
\Users\Admin\AppData\Local\Temp\~GMDCC9.exe

Filesize
201KB

MD5
5b73509f42f74767d622f468aeed17a9

SHA1
52096d51abd8222945e4cd11e4be2e014d61bd1a

SHA256
d563a8fd019b17290e1ef6f9046c10e562c20b9b90c51baa6a2845f160a088f9

SHA512
eefe481dfe25c4add9949f7258085066b1b8e688b07046a4e7965b682e6193fc7ee5873f3873996edb728b9ece883fd91ffdee4d10474abbefd63ae315a669f6

Download Submit
\Users\Admin\AppData\Local\Temp\~GMDCC9.exe

Filesize
201KB

MD5
5b73509f42f74767d622f468aeed17a9

SHA1
52096d51abd8222945e4cd11e4be2e014d61bd1a

SHA256
d563a8fd019b17290e1ef6f9046c10e562c20b9b90c51baa6a2845f160a088f9

SHA512
eefe481dfe25c4add9949f7258085066b1b8e688b07046a4e7965b682e6193fc7ee5873f3873996edb728b9ece883fd91ffdee4d10474abbefd63ae315a669f6

Download Submit
memory/672-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1472-57-0x0000000000000000-mapping.dmp

Download