7bffcfb02a86d4da984c2ba742bc27b4bb62399ed9837b9633cbd116269bc7c5

Analysis

max time kernel
96s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 22:36

Target
40a4d62c0a6870c1ed6a2a790c416d2b.exe
Size 89KB
Sample231225-2h7pasdad2
SHA256 7bffcfb02a86d4da984c2ba742bc27b4bb62399ed9837b9633cbd116269bc7c5
MD5 40a4d62c0a6870c1ed6a2a790c416d2b
SHA1 1d657e60926827b170a41648e0dfccba93b4dd5d
SHA512 e7522cfc99f636dd731d667e8a3b7edbe3a6418172cb0164dd07919841380eef9e42dea08209e38206771d5c36e26819e7afb4d13ff6afc467583459e051c58b
SSDEEP 1536:zgaLdNo2yb3wyNFeQsJ1EOCCovlzFgEOHgq9s+4sZH9WuBik0XFPTbMpMOc5eg+x:rLPo22jeQGaOloNzaW6ukQbI50eEZgC
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\glok+655f-971.sys	40a4d62c0a6870c1ed6a2a790c416d2b.exe
File created	C:\Windows\glok+serv.config	40a4d62c0a6870c1ed6a2a790c416d2b.exe
File opened for modification	C:\Windows\glok+serv.config	40a4d62c0a6870c1ed6a2a790c416d2b.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4224	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	25
PID 3980 wrote to memory of 4224	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	25
PID 3980 wrote to memory of 4224	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	25
PID 3980 wrote to memory of 1748	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	22
PID 3980 wrote to memory of 1748	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	22
PID 3980 wrote to memory of 1748	3980	40a4d62c0a6870c1ed6a2a790c416d2b.exe	22
PID 4224 wrote to memory of 4480	4224	w32tm.exe	20
PID 4224 wrote to memory of 4480	4224	w32tm.exe	20
PID 1748 wrote to memory of 3376	1748	w32tm.exe	19
PID 1748 wrote to memory of 3376	1748	w32tm.exe	19

C:\Users\Admin\AppData\Local\Temp\40a4d62c0a6870c1ed6a2a790c416d2b.exe
"C:\Users\Admin\AppData\Local\Temp\40a4d62c0a6870c1ed6a2a790c416d2b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\w32tm.exe
  w32tm /config /update
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- C:\Windows\SysWOW64\w32tm.exe
  w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224

C:\Windows\system32\w32tm.exe
w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
1⤵
PID:4480