ab08cb1279ca9edb9f2c8ca26e4785ad7db6aefaea3e952f20b50387fad0b9b1

Analysis

Target
AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe
Size 907KB
Sample211002-hs8jssdhd8
SHA256 ab08cb1279ca9edb9f2c8ca26e4785ad7db6aefaea3e952f20b50387fad0b9b1
MD5 4ea1be50c91ccd1dbadb711fc6a66e86
SHA1 7c57c02e4cf47b0d3449aada841ffc5f127bd41d
SHA512 2c8eb373a2fedea68f3bc9078a26102064309961f02d1d117dc26402b177a545dab941a405ec19dfe71748953c7effbf56a888c81a19ce9c9a094447272c0db4
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	1116	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1712	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1712	1116	AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe	27
PID 1116 wrote to memory of 1712	1116	AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe	27
PID 1116 wrote to memory of 1712	1116	AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe	27
PID 1116 wrote to memory of 1712	1116	AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe	27

C:\Users\Admin\AppData\Local\Temp\AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe
"C:\Users\Admin\AppData\Local\Temp\AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 584
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1712

memory/1116-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Download

memory/1116-55-0x0000000000350000-0x0000000000351000-memory.dmp

Download

memory/1712-57-0x0000000000240000-0x0000000000241000-memory.dmp

Download