77cad0bf3d030b2c9c1de4469730b2520a1ecd9db7e9428930c9419f5cc99952

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 22:23

Target

Çalışan İşlemler.exe
Size

6KB
MD5

568657a9030b5b1ad6fae3f752b5a759
SHA1

122355efce9c5f10d999d1edc237743e6211d497
SHA256

77cad0bf3d030b2c9c1de4469730b2520a1ecd9db7e9428930c9419f5cc99952
SHA512

02807beb88842794e23fc33ec2726258b9965a89c7cffdc912566ff37e4c8616bbdf88bbdb851197585af9be068868708f20c7839d8ab00e6776a877c0387057
SSDEEP

96:V3kmmxCmYh0Pzvhl6lLqUUswYmqTVlQXiubfKz50/0OQ0qwU090OzNt:/FePzvXGrwYmgybfO0/0d0JU090I

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2588	2732	Çalışan İşlemler.exe	29
PID 2732 wrote to memory of 2588	2732	Çalışan İşlemler.exe	29
PID 2732 wrote to memory of 2588	2732	Çalışan İşlemler.exe	29

C:\Users\Admin\AppData\Local\Temp\Çalışan İşlemler.exe
"C:\Users\Admin\AppData\Local\Temp\Çalışan İşlemler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2732 -s 496
  2⤵
  PID:2588

memory/2732-0-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Filesize
32KB

Download
memory/2732-1-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

Filesize
9.9MB

Download
memory/2732-2-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

Filesize
9.9MB

Download