Analysis
-
max time kernel
132s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-02-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
Swift mesajı 4.02.2022.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
Swift mesajı 4.02.2022.exe
-
Size
7KB
-
MD5
877b1a2b61c1b9d6580ddab9416a4f2a
-
SHA1
553657a0141dd16f29dbe8ac254b8ce77b8857b2
-
SHA256
d11763e5e7a68e1ebd3c8094630dd0d1e184e08eeb9a9d5e3f8200e7aeb9aea9
-
SHA512
c13d8cfa5bd0f8de604128085b5aebb582f9d07fb36ea11d35c214bb827d30658c9d0d32f3458d20a43ded6a2c8137cf80748bb139751a94800f0ff149bad24a
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1280 1072 WerFault.exe Swift mesajı 4.02.2022.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1280 WerFault.exe 1280 WerFault.exe 1280 WerFault.exe 1280 WerFault.exe 1280 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Swift mesajı 4.02.2022.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1072 Swift mesajı 4.02.2022.exe Token: SeDebugPrivilege 1280 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Swift mesajı 4.02.2022.exedescription pid process target process PID 1072 wrote to memory of 1280 1072 Swift mesajı 4.02.2022.exe WerFault.exe PID 1072 wrote to memory of 1280 1072 Swift mesajı 4.02.2022.exe WerFault.exe PID 1072 wrote to memory of 1280 1072 Swift mesajı 4.02.2022.exe WerFault.exe PID 1072 wrote to memory of 1280 1072 Swift mesajı 4.02.2022.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ Swift mesajı 4.02.2022.exe"C:\Users\Admin\AppData\Local\Temp\ Swift mesajı 4.02.2022.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 10922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1072-55-0x0000000000120000-0x0000000000128000-memory.dmpFilesize
32KB
-
memory/1072-56-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/1072-57-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1280-59-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB