5c046d79136779c5d2d1093a0ae1b45a61f4d49b0f8b8947e18bfccee2806559

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 15:03

Target
hareketleriniz .pdf.exe
Size 119KB
Sample231102-se6hdsdf5s
SHA256 5c046d79136779c5d2d1093a0ae1b45a61f4d49b0f8b8947e18bfccee2806559
MD5 ac17552680ce92bcdeee8d85dd23a094
SHA1 3834e08df86667af59ca7ca77be8536063fb490c
SHA512 0998215bf514c7aa6d0c664d78f19bbeb17686109bae943f0921d7323492bcfd796b131061a251303e970b2a60640d242555beeffec55bde2b542ad961b69dd6
SSDEEP 3072:pNAUxwbSVwS03k/oej4T5zYQxwNc1xNUPBC1C:pSU2bSVwrU/oeaYQxwNc1xKk1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	hareketleriniz .pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3044	2008	hareketleriniz .pdf.exe	28
PID 2008 wrote to memory of 3044	2008	hareketleriniz .pdf.exe	28
PID 2008 wrote to memory of 3044	2008	hareketleriniz .pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\hareketleriniz .pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hareketleriniz .pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2008 -s 1176
  2⤵
  PID:3044

memory/2008-0-0x0000000000960000-0x0000000000982000-memory.dmp

Download

memory/2008-1-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Download

memory/2008-2-0x000000001BBC0000-0x000000001BC40000-memory.dmp

Download

memory/2008-3-0x0000000000750000-0x0000000000756000-memory.dmp

Download

memory/2008-4-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Download

memory/2008-5-0x000000001BBC0000-0x000000001BC40000-memory.dmp

Download