Analysis
-
max time kernel
149s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28/10/2022, 19:00
General
-
Target
TRMSBEN00237 HK acil FİYAT TEKLİFİ PO10939202.exe
-
Size
785KB
-
MD5
aaa417b91a2c24bdf448d9056b6ba263
-
SHA1
666a686e5d51b2f11078270d9424da6fa8ce0bb7
-
SHA256
12050271ba333bbc55aca8540cb433b317c8b043fcc4f49e2013706f03834851
-
SHA512
cf8046d99b5f846601c752d764411ac708b00e088c99a38925d75468b987dfeabb2acf1fb5c740f35fa79af135bb5293d0f282343b33a0731e4b07649542fa89
-
SSDEEP
12288:Rpuh7jmbFvZ9XoyMiQ6agDLh/DeQMKL1aahk8rC9qgKqmkyb9kp4VLfEYQI:7bFFMi4ghD/pxjrsqgKqmkyeiLchI
Score
3/10
Malware Config
Signatures
-
Program crash 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRMSBEN00237 HK acil FİYAT TEKLİFİ PO10939202.exe"C:\Users\Admin\AppData\Local\Temp\TRMSBEN00237 HK acil FİYAT TEKLİFİ PO10939202.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 13202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 13202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3560 -ip 35601⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
808KB
-
Filesize
584KB
-
Filesize
624KB