5fe5a55457de5cc7d0042b3d4bd4d60f30340e31cb4ca60fcb775a393dd0ae6d

Analysis

max time kernel
45s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30/05/2023, 06:20

Target

Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe
Size

768KB
MD5

3124c50492073355bdaab17053325375
SHA1

3563898c2347ec87992728732fb903479b963a87
SHA256

5fe5a55457de5cc7d0042b3d4bd4d60f30340e31cb4ca60fcb775a393dd0ae6d
SHA512

669f818be4618a884405691e0f093f4f4df207c7943764bb8a9f3d123911a8e778b4675769eeb65e4f3018046c630a71550d2a147203cc3e2016780e68041401
SSDEEP

12288:kRP2B0xTGlxNqvNu2hZ+nUEsn9JggGEOS80Cc+yHr5wdnF3yRLgbZUp8DQit2lJ6:gPLaVUH999Jg7GndHr5wRF3VaYs7fC1x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	528	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
528	Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe
528	Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	528	Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 972	528	Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe	28
PID 528 wrote to memory of 972	528	Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe	28
PID 528 wrote to memory of 972	528	Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe	28
PID 528 wrote to memory of 972	528	Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe	28

C:\Users\Admin\AppData\Local\Temp\Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe
"C:\Users\Admin\AppData\Local\Temp\Aygün Cerrahi Aletler A.Ş_Teklif İsteği_ürün Etiket hk.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 724
  2⤵
  - Program crash
  PID:972

memory/528-54-0x0000000000E00000-0x0000000000EC2000-memory.dmp

Filesize
776KB

Download
memory/528-55-0x0000000004C10000-0x0000000004C50000-memory.dmp

Filesize
256KB

Download
memory/528-56-0x0000000000490000-0x00000000004A4000-memory.dmp

Filesize
80KB

Download
memory/528-57-0x0000000004C10000-0x0000000004C50000-memory.dmp

Filesize
256KB

Download
memory/528-58-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/528-59-0x0000000000D90000-0x0000000000E06000-memory.dmp

Filesize
472KB

Download
memory/528-60-0x00000000055D0000-0x000000000560E000-memory.dmp

Filesize
248KB

Download