0b28e11377a023f06d0cf8035e3b2146192004b32e1d0079d01a4958b639eb0d | Triage

Analysis

max time kernel
135s
max time network
67s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 07:14

Sharing

Report Analysis Logs

General

Target

DHL0117389200183PDF.exe
Size

694KB
MD5

54c61c56674b4454fd32e775f81bd278
SHA1

a92461392621be1c194df73a1566c32aae0bbd93
SHA256

0b28e11377a023f06d0cf8035e3b2146192004b32e1d0079d01a4958b639eb0d
SHA512

7a6d9959728a5ff97249fe5a561b54635a740039cac26178c84ee07e0cce86730d1a1583810750574309905454f63915a8164ee70a882627284d22f36af2614d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3692 1516 WerFault.exe DHL0117389200183PDF.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

DHL0117389200183PDF.exeWerFault.exe

pid	process
1516	DHL0117389200183PDF.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

DHL0117389200183PDF.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1516	DHL0117389200183PDF.exe
Token: SeRestorePrivilege	3692	WerFault.exe
Token: SeBackupPrivilege	3692	WerFault.exe
Token: SeDebugPrivilege	3692	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL0117389200183PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL0117389200183PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 932
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3692-0-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/3692-1-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download