9fc1257fd3272952900bbf3a49b53efa12afa7859cea80271472bf3432de4288

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 10:53

Target

Ödeme Onayı Kopyası.exe
Size

809KB
MD5

c6f894c845f60405a86dab3c02991220
SHA1

2543c38645b8fc6e014b4fed859e2de41f18f9ad
SHA256

9fc1257fd3272952900bbf3a49b53efa12afa7859cea80271472bf3432de4288
SHA512

740a61169dba17cc42d74872f1ed79d3774717a1111669069b455926be68ca10511d503c6c5c672efee6ea321ba8de063532c06c0e1569e6d954d2b354a56f92
SSDEEP

24576:TCc0BBN1FdkYb+IIOzmaRF38ujFYbddme7v2sE5C:TCc01KYbzFh77FYbdFCs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	1620	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	Ödeme Onayı Kopyası.exe
1620	Ödeme Onayı Kopyası.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	Ödeme Onayı Kopyası.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1860	1620	Ödeme Onayı Kopyası.exe	31
PID 1620 wrote to memory of 1860	1620	Ödeme Onayı Kopyası.exe	31
PID 1620 wrote to memory of 1860	1620	Ödeme Onayı Kopyası.exe	31
PID 1620 wrote to memory of 1860	1620	Ödeme Onayı Kopyası.exe	31

C:\Users\Admin\AppData\Local\Temp\Ödeme Onayı Kopyası.exe
"C:\Users\Admin\AppData\Local\Temp\Ödeme Onayı Kopyası.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 780
  2⤵
  - Program crash
  PID:1860

memory/1620-0-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x0000000000850000-0x0000000000920000-memory.dmp

Filesize
832KB

Download
memory/1620-2-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download
memory/1620-3-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1620-4-0x00000000003B0000-0x00000000003B8000-memory.dmp

Filesize
32KB

Download
memory/1620-5-0x00000000003C0000-0x00000000003CE000-memory.dmp

Filesize
56KB

Download
memory/1620-6-0x0000000004E30000-0x0000000004EB2000-memory.dmp

Filesize
520KB

Download
memory/1620-7-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

Filesize
4KB

Download
memory/1620-8-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download