88e06b037f0a779dce49389c9f1e028b8aee5a2f258e4a6e34c53d331dd438ac

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 19:28

Target

Ziraat Bankas Swift Mesaj.exe
Size

63KB
MD5

997e9dee32f310ff10617cd6b459f0d8
SHA1

05ef76e825494cfd27bb244fc4676577cbd4c26c
SHA256

88e06b037f0a779dce49389c9f1e028b8aee5a2f258e4a6e34c53d331dd438ac
SHA512

0f90561fd2e7296dd008f90e0e47eae2d01d0f26a8f3ac39f8a1b10927ed9551e56c6cf527f625f3cd66af3fc68ca26dd581adcb20cfa87e1e639771f87b9833
SSDEEP

768:E0Uj4B+6rOqTaSErl95UpVD6lbCNc5UEy67HMbswkyJ/UILOtlCX/XGqmd98NMYk:3S5ColbCNN6jMI2MtlCXOqnNMyTixPd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
328	1604	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	Ziraat Bankas Swift Mesaj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 328	1604	Ziraat Bankas Swift Mesaj.exe	27
PID 1604 wrote to memory of 328	1604	Ziraat Bankas Swift Mesaj.exe	27
PID 1604 wrote to memory of 328	1604	Ziraat Bankas Swift Mesaj.exe	27
PID 1604 wrote to memory of 328	1604	Ziraat Bankas Swift Mesaj.exe	27

C:\Users\Admin\AppData\Local\Temp\Ziraat Bankas Swift Mesaj.exe
"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankas Swift Mesaj.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1188
  2⤵
  - Program crash
  PID:328

memory/1604-54-0x0000000000A00000-0x0000000000A16000-memory.dmp

Filesize
88KB

Download
memory/1604-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download