d6a06ea85b9e39e2f7ac8dacb3a3d2a410ff82a0bbd0d1d277156834e98a529a | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 06:17

Sharing

Report Analysis Logs

General

Target

hareketleriniz.exe
Size

63KB
MD5

227bdbb8c34884f8dbff3a7b02a16d01
SHA1

63b5aa25d682d370061df48c188083fe5de0834d
SHA256

d6a06ea85b9e39e2f7ac8dacb3a3d2a410ff82a0bbd0d1d277156834e98a529a
SHA512

6ef3a6aec7ab1eefd8ab3e0aa8b04c6fe7bef0d467fab2bbef3530661c21037a582ead137171817d6a2dfcd01d3b0be63556cf4baf3a46b59a37f7ae4ad994ad
SSDEEP

1536:hgruVyPHmDMLKTZgVYVjvoHZ+lDpFCB0:huGMjaVToHZ+lDpFa0

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hareketleriniz.exe

description pid process

Token: SeDebugPrivilege 3052 hareketleriniz.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

hareketleriniz.exe

description	pid	process	target process
PID 3052 wrote to memory of 2832	3052	hareketleriniz.exe	WerFault.exe
PID 3052 wrote to memory of 2832	3052	hareketleriniz.exe	WerFault.exe
PID 3052 wrote to memory of 2832	3052	hareketleriniz.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\hareketleriniz.exe
"C:\Users\Admin\AppData\Local\Temp\hareketleriniz.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3052 -s 1172
2⤵
PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-0-0x0000000000940000-0x0000000000954000-memory.dmp

Filesize
80KB

Download
memory/3052-1-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-2-0x000000001BBB0000-0x000000001BC30000-memory.dmp

Filesize
512KB

Download
memory/3052-3-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download