db0270b977bf68fb8ce2e161bae88c7dd4ed82866b3bbc3d6c8a713edc69db53

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 06:29

Target

chatgpt.exe
Size

658.8MB
MD5

d3fbcca7d5fd818a9f1004c4e6b95fe3
SHA1

1487d9dfcaf863e279f9830affb851f3e9688d08
SHA256

5ff4a408a6578451248d8d7a5a9be2c75162f5406b143df9f46b83e30fa63226
SHA512

3accd3a3fb7697c602f1fc3601560a23f3bfd910c8cd5154b3130aa40230494b17c7b6962dce28e74be06df696433425bd5e0e7f6325eb44458644779134d361
SSDEEP

12288:7p/5R0g6QwlJRGLAIBcosKn7SJ1chc3wZbM2XhGcmOZMDomIoH3LdrscwZ6VHZY+:7x6n7RGhBcosKn701wXV1q

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1412 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1412 powershell.exe

pid	process
1412	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1412	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

chatgpt.exe

description	pid	process	target process
PID 1756 wrote to memory of 1412	1756	chatgpt.exe	powershell.exe
PID 1756 wrote to memory of 1412	1756	chatgpt.exe	powershell.exe
PID 1756 wrote to memory of 1412	1756	chatgpt.exe	powershell.exe
PID 1756 wrote to memory of 1412	1756	chatgpt.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\chatgpt.exe
"C:\Users\Admin\AppData\Local\Temp\chatgpt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

memory/1412-56-0x0000000000000000-mapping.dmp

Download
memory/1412-58-0x00000000739A0000-0x0000000073F4B000-memory.dmp

Filesize
5.7MB

Download
memory/1412-59-0x00000000739A0000-0x0000000073F4B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-54-0x0000000000CD0000-0x0000000000D5A000-memory.dmp

Filesize
552KB

Download
memory/1756-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download