6a880a0171c798787efbfbb86d5f97f2fba2787e6edf4377726948c3dc05c3d2 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 15:31

Sharing

Report Analysis Logs

General

Target

yeni sipariş123.exe
Size

1.0MB
MD5

488f22f68bd7f844eff2b28d64390dad
SHA1

2d0fad853634619a3826edb29396d9535b4ca75f
SHA256

6a880a0171c798787efbfbb86d5f97f2fba2787e6edf4377726948c3dc05c3d2
SHA512

f85de7d76e2b5fc9583b6c7ea945be1eedc0d36dd428c2c164f60f4efd45379a5d0ffa3e42de057fbaaee4e54773ef670a6b3c8842f64f9b956b3f609b76d769
SSDEEP

12288:iHGDiVBYG9M3+hX9O7L1GepaS9x5lXHjlRxThf/vJGRTwrEbx:im+VBtMOhXowepf3BHpRx1fHJTYV

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	1212	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1460	1212	yeni sipariş123.exe	28
PID 1212 wrote to memory of 1460	1212	yeni sipariş123.exe	28
PID 1212 wrote to memory of 1460	1212	yeni sipariş123.exe	28
PID 1212 wrote to memory of 1460	1212	yeni sipariş123.exe	28

C:\Users\Admin\AppData\Local\Temp\yeni sipariş123.exe
"C:\Users\Admin\AppData\Local\Temp\yeni sipariş123.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 648
  2⤵
  - Program crash
  PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-54-0x0000000000870000-0x000000000097A000-memory.dmp

Filesize
1.0MB

Download
memory/1212-55-0x0000000004B30000-0x0000000004B70000-memory.dmp

Filesize
256KB

Download