6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 08:53

Target

Swift Raporu_20240425_283992772777.exe
Size

888KB
MD5

7c5508484d8b61155b13bb8476fb5f70
SHA1

ab2be33782022e9f04dcbe25633d5c362193ecf3
SHA256

6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323
SHA512

7245fe40ba2ae2f81ac956b71b9962eee64382e3171da3f4d55a9748ee992ee3c861d02712d5aa0f04155146879a58d6bee966dd5e638d413593b26d2ecf9643
SSDEEP

24576:2wGf9bYNj0WU66TcnohHWJxpyz+epkQ4/Kh9YX3:A6OWU6dUoxpy14/KUH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Swift Raporu_20240425_283992772777.exe

description pid process

Token: SeDebugPrivilege 2008 Swift Raporu_20240425_283992772777.exe

description	pid	process
Token: SeDebugPrivilege	2008	Swift Raporu_20240425_283992772777.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Swift Raporu_20240425_283992772777.exe

description	pid	process	target process
PID 2008 wrote to memory of 2440	2008	Swift Raporu_20240425_283992772777.exe	WerFault.exe
PID 2008 wrote to memory of 2440	2008	Swift Raporu_20240425_283992772777.exe	WerFault.exe
PID 2008 wrote to memory of 2440	2008	Swift Raporu_20240425_283992772777.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2008 -s 580
2⤵
PID:2440

memory/2008-0-0x0000000000060000-0x00000000000B0000-memory.dmp

Filesize
320KB

Download
memory/2008-1-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2008-2-0x000000001B330000-0x000000001B3B0000-memory.dmp

Filesize
512KB

Download
memory/2008-3-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2008-4-0x000000001B330000-0x000000001B3B0000-memory.dmp

Filesize
512KB

Download