7bffcfb02a86d4da984c2ba742bc27b4bb62399ed9837b9633cbd116269bc7c5

Analysis

max time kernel
96s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 22:36

Target

40a4d62c0a6870c1ed6a2a790c416d2b.exe
Size

89KB
MD5

40a4d62c0a6870c1ed6a2a790c416d2b
SHA1

1d657e60926827b170a41648e0dfccba93b4dd5d
SHA256

7bffcfb02a86d4da984c2ba742bc27b4bb62399ed9837b9633cbd116269bc7c5
SHA512

e7522cfc99f636dd731d667e8a3b7edbe3a6418172cb0164dd07919841380eef9e42dea08209e38206771d5c36e26819e7afb4d13ff6afc467583459e051c58b
SSDEEP

1536:zgaLdNo2yb3wyNFeQsJ1EOCCovlzFgEOHgq9s+4sZH9WuBik0XFPTbMpMOc5eg+x:rLPo22jeQGaOloNzaW6ukQbI50eEZgC

Score

4^/10

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\glok+655f-971.sys	40a4d62c0a6870c1ed6a2a790c416d2b.exe
File created	C:\Windows\glok+serv.config	40a4d62c0a6870c1ed6a2a790c416d2b.exe
File opened for modification	C:\Windows\glok+serv.config	40a4d62c0a6870c1ed6a2a790c416d2b.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4224	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	25
PID 3980 wrote to memory of 4224	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	25
PID 3980 wrote to memory of 4224	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	25
PID 3980 wrote to memory of 1748	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	22
PID 3980 wrote to memory of 1748	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	22
PID 3980 wrote to memory of 1748	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	22
PID 4224 wrote to memory of 4480	4224	w32tm.exe	20
PID 4224 wrote to memory of 4480	4224	w32tm.exe	20
PID 1748 wrote to memory of 3376	1748	w32tm.exe	19
PID 1748 wrote to memory of 3376	1748	w32tm.exe	19

C:\Users\Admin\AppData\Local\Temp\40a4d62c0a6870c1ed6a2a790c416d2b.exe
"C:\Users\Admin\AppData\Local\Temp\40a4d62c0a6870c1ed6a2a790c416d2b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\w32tm.exe
  w32tm /config /update
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- C:\Windows\SysWOW64\w32tm.exe
  w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224

C:\Windows\system32\w32tm.exe
w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
1⤵
PID:4480