47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe
Size

8.9MB
MD5

b727c4b8da1ee4dd1c17c26aa02d92ac
SHA1

ac3e53f12a05b784cf5d5f8e12701622fcac0c7f
SHA256

47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f
SHA512

5bf52a66fdcf7bb59de92485d493c06bea77db945c674047d853da0ad3a2ae36ce772c0fa60414fabf21f16d3a9254bac01ae9d0d05d6c6d161ebf98ce14b2c4
SSDEEP

196608:Oebi/FQ9pwv8A7fmb0cW8X4fx04lZDcteXIncqGZjZjW:O+i/o5A7eMjlZDctBncrj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1292	gpuz_installer.exe
456	gpuz_installer.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2556	47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1292	2556	47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe	91
PID 2556 wrote to memory of 1292	2556	47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe	91
PID 2556 wrote to memory of 1292	2556	47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe	91
PID 1292 wrote to memory of 456	1292	gpuz_installer.exe	92
PID 1292 wrote to memory of 456	1292	gpuz_installer.exe	92
PID 1292 wrote to memory of 456	1292	gpuz_installer.exe	92

C:\Users\Admin\AppData\Local\Temp\47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe
"C:\Users\Admin\AppData\Local\Temp\47c05af7feb0ac5ec3b4cdc955a5dc276c31fa1d06dbeb4dd88b7b484fa9a53f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\is-B1UIC.tmp\gpuz_installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-B1UIC.tmp\gpuz_installer.tmp" /SL5="$90228,721408,721408,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"
    3⤵
    - Executes dropped EXE
    PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GPU-Z.exe

Filesize
381KB

MD5
6c2a58139b96faea6305c574bac938db

SHA1
4b9698adb62013172654127b4fad867692581134

SHA256
0f6cfaf5a3bda3c0ddf6e027da6e743349ea18554ff58524a03c9692b79c69ef

SHA512
9722276a64ef95914b37ef14ba11ee2dc75b146a538ad781d249ebf4eaf4b967e4254a76769c2413ea483fde8c1d67887dfca9b788e5ae5ee14e567e271fbd5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe

Filesize
288KB

MD5
fb7f9c30ad84932e0f3b47fa42119ed8

SHA1
887d0a45019c99e5891c342e2e8aa7bf878baf3c

SHA256
7e0faf19ffcfc53eb2734c819a9a0766d500c372855c4eeb337d0f466bad71fe

SHA512
30d4f54fcfef4757811d012e230f2d32bb896a1272fbac48cc361be202bcad0641c2c294c87e9b1d70a3a9a07c6a22afa2ff6b4c6aef77013d07dbf8455398d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe

Filesize
375KB

MD5
e0acf6623d7eab9a5397711656cc09ea

SHA1
7ac88fad5f7b7cd5add5e16889c655fe90e44255

SHA256
d848f152cc28b3fc838072acc78f5587237538dda20d08b0ffeed68b27053af3

SHA512
28f414139eccc363e8739e25a3a4b13bba32569ccfbefa2ec6ae808d56d928702741b5d3a0b92b66df257d56cf6d9e0fc2c4ac7645f5f38bf59f8047d542d5cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-B1UIC.tmp\gpuz_installer.tmp

Filesize
85KB

MD5
5b4f87bdf9eef143ce519b2c66a38937

SHA1
769217e4ee63c764c08986c67dd031ac5ac34613

SHA256
c6a5c7ce2dcfff5a99f929729a134a177d9a72e1b9454e4258863fa528fc9304

SHA512
4c300678ef5753c6397f9a269550f90a04ec28ce3ad7552c399d22311041913b3a3d666bfdb1c34b0e5813e00e18457d28d101390e318107b9fb7fca7165baa4

Download Submit
memory/456-15-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/456-21-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/456-27-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1292-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1292-19-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2556-0-0x0000000000400000-0x0000000002C80000-memory.dmp

Filesize
40.5MB

Download
memory/2556-2-0x0000000000400000-0x0000000002C80000-memory.dmp

Filesize
40.5MB

Download
memory/2556-3-0x0000000000400000-0x0000000002C80000-memory.dmp

Filesize
40.5MB

Download
memory/2556-1-0x0000000002F10000-0x0000000002F13000-memory.dmp

Filesize
12KB

Download
memory/2556-18-0x0000000000400000-0x0000000002C80000-memory.dmp

Filesize
40.5MB

Download
memory/2556-20-0x0000000002F10000-0x0000000002F13000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads