23d1c6499e80a747b00743982c6fc174e6e0d09eeed15843e265090bafcb4004 | Triage

Analysis

max time kernel
71s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 07:29

Sharing

Report Analysis Logs

General

Target

GHelper.exe
Size

5.1MB
MD5

1c70a960b17f585d389c81ffdaf4aff9
SHA1

dd741a198b9de50722453260e07a828150101f62
SHA256

23d1c6499e80a747b00743982c6fc174e6e0d09eeed15843e265090bafcb4004
SHA512

68708d2aba4c6b703638fdc8560999fe69f9671b5005d98a3a1f93cda07ce763562ae39d81a0857f4eac2b0aadbd58c41567e94b74a0ea2a2e62b22f996b9eb6
SSDEEP

49152:0fJbCtRliigQyx+egLvSLqlX/9mUFwnCJZbUWyeaTDtxOqC12kvVU6wdhOjVLxO:EMVgQyuFwv+gdf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3360	GHelper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	GHelper.exe

C:\Users\Admin\AppData\Local\Temp\GHelper.exe
"C:\Users\Admin\AppData\Local\Temp\GHelper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads