Analysis
- max time kernel
97s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
04/04/2023, 15:22
General
- Target REVİZE BELGELERİ.exe
- Size 829KB
- Sample230404-srwtqaaa7v
- SHA256 778782d68c349fbb021a749f1370c2446c19cd3a64e7891c84c55ddf834f2e02
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVİZE BELGELERİ.exe"C:\Users\Admin\AppData\Local\Temp\REVİZE BELGELERİ.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 13362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1236 -ip 12361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1236-133-0x00000000002F0000-0x00000000003C6000-memory.dmp
memory/1236-134-0x0000000005430000-0x00000000059D4000-memory.dmp
memory/1236-135-0x0000000004D70000-0x0000000004E02000-memory.dmp
memory/1236-136-0x0000000005000000-0x0000000005010000-memory.dmp
memory/1236-137-0x0000000004E30000-0x0000000004E3A000-memory.dmp
memory/1236-138-0x0000000005000000-0x0000000005010000-memory.dmp
memory/1236-139-0x0000000006B40000-0x0000000006BDC000-memory.dmp