3104ce8f8a8a738b2632d971f672d3fcb579482f5d86b2834ba2d2481dd00664

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 09:02

Target

SATIN ALMA EMRİ.exe
Size

965KB
MD5

a50085c500bda33dcf346fb1195bd6ef
SHA1

c17a8b9c2daebd664d300e2c3195831ee569656d
SHA256

aad2a877b65aa897bae133006b9b31902a08472fffd7d19eeb6d781d0b84931a
SHA512

f4883d08d01b76cf141e48689343553d0211abcfd95c0458215f1fd93106642f5aebeb55aa866e2d8a3a51faf519329c9f4a62ca08be5e8bb1afb23297e50c62
SSDEEP

12288:uSciP7s9ywI1D4g7M+bnhzKDZN0uQhRsXg8Vn5O5CDzqWSlse2KHcnX:HciP7s9yt4g7M0dKDBQhiXg86MzkbH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	1964	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1964	SATIN ALMA EMRİ.exe
1964	SATIN ALMA EMRİ.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	SATIN ALMA EMRİ.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2812	1964	SATIN ALMA EMRİ.exe	30
PID 1964 wrote to memory of 2812	1964	SATIN ALMA EMRİ.exe	30
PID 1964 wrote to memory of 2812	1964	SATIN ALMA EMRİ.exe	30
PID 1964 wrote to memory of 2812	1964	SATIN ALMA EMRİ.exe	30

C:\Users\Admin\AppData\Local\Temp\SATIN ALMA EMRİ.exe
"C:\Users\Admin\AppData\Local\Temp\SATIN ALMA EMRİ.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 736
  2⤵
  - Program crash
  PID:2812

memory/1964-0-0x0000000000C60000-0x0000000000D58000-memory.dmp

Filesize
992KB

Download
memory/1964-1-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/1964-2-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Filesize
256KB

Download
memory/1964-3-0x0000000000560000-0x0000000000578000-memory.dmp

Filesize
96KB

Download
memory/1964-4-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/1964-5-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Filesize
256KB

Download
memory/1964-6-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/1964-7-0x0000000005880000-0x00000000058FC000-memory.dmp

Filesize
496KB

Download