255e3929c9c01618bdcbf338a119b206ae2e06b4bc865cc96d712aeba59f3da1

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 11:54

Target
FATURA ÖDEMESİ.exe
Size 749KB
Sample221207-n2wt9adh97
SHA256 255e3929c9c01618bdcbf338a119b206ae2e06b4bc865cc96d712aeba59f3da1
MD5 4855c2b4284a1bc9d9bc4032d02eb55f
SHA1 dfb3e06e2fac2173f9505d508b5dff42512f2d6c
SHA512 ce3bb2ab139cb6310b31a3197f4801a0fc04fbafa88d5c9b0a08b37a2bbf51ef154b91b09afe989b8b1abf06e0acaa8d3ff06cc01eb0f5e836cb8cc80dd1f4fc
SSDEEP 12288:zoFPmomPZefMakllzfRJJLp458K5RRToNHLHgLNsxqsu0HjW1H9qMCJqcF5F:8EomxiK/zfhpOfoZLHWS1yR9qAcv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	2036	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 268	2036	FATURA ÖDEMESİ.exe	28
PID 2036 wrote to memory of 268	2036	FATURA ÖDEMESİ.exe	28
PID 2036 wrote to memory of 268	2036	FATURA ÖDEMESİ.exe	28
PID 2036 wrote to memory of 268	2036	FATURA ÖDEMESİ.exe	28

C:\Users\Admin\AppData\Local\Temp\FATURA ÖDEMESİ.exe
"C:\Users\Admin\AppData\Local\Temp\FATURA ÖDEMESİ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 704
  2⤵
  - Program crash
  PID:268

memory/2036-54-0x0000000000D20000-0x0000000000DE2000-memory.dmp

Download

memory/2036-55-0x0000000076531000-0x0000000076533000-memory.dmp

Download