b0476a5dc2e0d5972cf1dc23276427900cdbe24d97e5004d7418b16bcc248004

Analysis

max time kernel
49s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-05-2023 17:56

Target

ödenmiş fatura.exe
Size

700.6MB
MD5

ae0381dd9ed8f12c287e9b77db1fa22d
SHA1

d21a78321391b67aa24af3e493823bd508896456
SHA256

3630177cce457686c937fcccc2291e0d01b57dbfd720a43cd6d295e695c5b354
SHA512

554a3bac206518c19e819f19e8fd7db3a47d00282b3287b335756f49a55b4e3bd7c2e1cd1b8037f697598348e92d9661b6ef6536714dfa8266604a99b28b3ecb
SSDEEP

12288:p+nGsnwf7Vo7viwTMGQ842T7k/v1uNJbrgOyDRPzMfBQ4xso:WsBuvjJ4ykkNJZuRPI6a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
580	1720	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	ödenmiş fatura.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	ödenmiş fatura.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 580	1720	ödenmiş fatura.exe	28
PID 1720 wrote to memory of 580	1720	ödenmiş fatura.exe	28
PID 1720 wrote to memory of 580	1720	ödenmiş fatura.exe	28
PID 1720 wrote to memory of 580	1720	ödenmiş fatura.exe	28

C:\Users\Admin\AppData\Local\Temp\ödenmiş fatura.exe
"C:\Users\Admin\AppData\Local\Temp\ödenmiş fatura.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 692
  2⤵
  - Program crash
  PID:580

memory/1720-54-0x0000000000F20000-0x0000000000FC0000-memory.dmp

Filesize
640KB

Download
memory/1720-55-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/1720-56-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download
memory/1720-57-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/1720-58-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/1720-59-0x0000000005600000-0x000000000566A000-memory.dmp

Filesize
424KB

Download
memory/1720-60-0x0000000000EC0000-0x0000000000EF2000-memory.dmp

Filesize
200KB

Download