Analysis
- max time kernel
98s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
09/03/2023, 19:56
General
- Target FIYAT TALEBI FABRİKA FİYATI ADET __PO2301005.exe
- Size 1.1MB
- Sample230309-ynnxlabf5w
- SHA256 29eed0d6a1854d6ae9a45e6ba66ea6cef25a4175a1fff52937fae7fe5dc9813e
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FIYAT TALEBI FABRİKA FİYATI ADET __PO2301005.exe"C:\Users\Admin\AppData\Local\Temp\FIYAT TALEBI FABRİKA FİYATI ADET __PO2301005.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 12162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4088 -ip 40881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4088-133-0x0000000000B60000-0x0000000000C84000-memory.dmp
memory/4088-134-0x0000000005BF0000-0x0000000006194000-memory.dmp
memory/4088-135-0x0000000005640000-0x00000000056D2000-memory.dmp
memory/4088-136-0x0000000005870000-0x0000000005880000-memory.dmp
memory/4088-137-0x00000000057D0000-0x00000000057DA000-memory.dmp
memory/4088-138-0x0000000005870000-0x0000000005880000-memory.dmp
memory/4088-139-0x0000000007160000-0x00000000071FC000-memory.dmp