913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 16:46

Target

Odeme_Fatura.exe
Size

582KB
MD5

7bee43d88ddd5717c4059960d4f7abbb
SHA1

51768285fb6047a523af3d28e3e8601fa17a181d
SHA256

913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3
SHA512

b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd
SSDEEP

12288:nSQ3xl2I6NRNXDrI9GeZnbfPJJgR5lbULc1tBWpK9s3FqFLtomQ:Bf6rNX1eVXjGbt1oqFLtoN

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 4468	3592	Odeme_Fatura.exe	30
PID 3592 set thread context of 3304	3592	Odeme_Fatura.exe	29

Program crash 2 IoCs

pid	pid_target	Process
3580	4468	WerFault.exe
2736	3304	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	Odeme_Fatura.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 4468	3592	Odeme_Fatura.exe	30
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29
PID 3592 wrote to memory of 3304	3592	Odeme_Fatura.exe	29

C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
"C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  2⤵
  PID:3304
- C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  2⤵
  PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4468 -ip 4468
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3304 -ip 3304
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 80
1⤵
- Program crash
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 80
1⤵
- Program crash
PID:2736

memory/3592-1-0x0000000000910000-0x00000000009AC000-memory.dmp

Filesize
624KB

Download
memory/3592-2-0x0000000005290000-0x0000000005296000-memory.dmp

Filesize
24KB

Download
memory/3592-6-0x0000000004C30000-0x0000000004C36000-memory.dmp

Filesize
24KB

Download
memory/3592-5-0x000000000DEA0000-0x000000000DF3C000-memory.dmp

Filesize
624KB

Download
memory/3592-4-0x000000000DD70000-0x000000000DE04000-memory.dmp

Filesize
592KB

Download
memory/3592-3-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/3592-0-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/3592-10-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download