6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 08:48

Target

Swift Raporu_20240425_283992772777.exe
Size

888KB
MD5

7c5508484d8b61155b13bb8476fb5f70
SHA1

ab2be33782022e9f04dcbe25633d5c362193ecf3
SHA256

6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323
SHA512

7245fe40ba2ae2f81ac956b71b9962eee64382e3171da3f4d55a9748ee992ee3c861d02712d5aa0f04155146879a58d6bee966dd5e638d413593b26d2ecf9643
SSDEEP

24576:2wGf9bYNj0WU66TcnohHWJxpyz+epkQ4/Kh9YX3:A6OWU6dUoxpy14/KUH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Swift Raporu_20240425_283992772777.exe

description pid process

Token: SeDebugPrivilege 2924 Swift Raporu_20240425_283992772777.exe

description	pid	process
Token: SeDebugPrivilege	2924	Swift Raporu_20240425_283992772777.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Swift Raporu_20240425_283992772777.exe

description	pid	process	target process
PID 2924 wrote to memory of 2984	2924	Swift Raporu_20240425_283992772777.exe	WerFault.exe
PID 2924 wrote to memory of 2984	2924	Swift Raporu_20240425_283992772777.exe	WerFault.exe
PID 2924 wrote to memory of 2984	2924	Swift Raporu_20240425_283992772777.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Swift Raporu_20240425_283992772777.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Raporu_20240425_283992772777.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2924 -s 576
  2⤵
  PID:2984

memory/2924-0-0x0000000000E20000-0x0000000000E70000-memory.dmp

Filesize
320KB

Download
memory/2924-1-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download
memory/2924-2-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/2924-3-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download
memory/2924-4-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download