Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 10:13
General
-
Target
hesaphareketi-01.exe
-
Size
33KB
-
MD5
38e162610466dd251d9b377a60f65c11
-
SHA1
2a597d5198230eaafe8d842e76776192ba3e6742
-
SHA256
7eb784edddde0eddd7b21c4907916f0109334a4237a9c2eb917caf8eae81480f
-
SHA512
385a3a4d1592539e64a14a096ab50f86925376cca6cd23dce1f88cf636affce84cd16c8716b68889bc10cb514822adc26bc2aec4cd6b6200fbbee611740994bc
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 15882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/324-57-0x0000000000000000-mapping.dmp
-
memory/324-58-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/2024-53-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2024-55-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/2024-56-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB