095d9489f869a9b368679cf2f9aa49f3085b360bd9b36e9d49050821e0b83e87

General

Target

DHL Shipment Notification Status AWB811470484778.exe
Size

458KB
MD5

644bfd229ad251d58b39c3b2c48ac4a5
SHA1

be354ee15cf727285b933ec6646299725fc3c918
SHA256

095d9489f869a9b368679cf2f9aa49f3085b360bd9b36e9d49050821e0b83e87
SHA512

f201f9d7510ceb03bc9a3233a850f7a340fa3e0b07e4463859dd41b1b7dc3ec2f3408a432f561c8ae88e102e52c0c7531f47b552292f69a96eabd87ccb2764d1

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1800	1008	DHL Shipment Notification Status AWB811470484778.exe	26
PID 1008 wrote to memory of 1800	1008	DHL Shipment Notification Status AWB811470484778.exe	26
PID 1008 wrote to memory of 1800	1008	DHL Shipment Notification Status AWB811470484778.exe	26
PID 1008 wrote to memory of 1380	1008	DHL Shipment Notification Status AWB811470484778.exe	27
PID 1008 wrote to memory of 1380	1008	DHL Shipment Notification Status AWB811470484778.exe	27
PID 1008 wrote to memory of 1380	1008	DHL Shipment Notification Status AWB811470484778.exe	27
PID 1008 wrote to memory of 1288	1008	DHL Shipment Notification Status AWB811470484778.exe	28
PID 1008 wrote to memory of 1288	1008	DHL Shipment Notification Status AWB811470484778.exe	28
PID 1008 wrote to memory of 1288	1008	DHL Shipment Notification Status AWB811470484778.exe	28
PID 1008 wrote to memory of 1832	1008	DHL Shipment Notification Status AWB811470484778.exe	29
PID 1008 wrote to memory of 1832	1008	DHL Shipment Notification Status AWB811470484778.exe	29
PID 1008 wrote to memory of 1832	1008	DHL Shipment Notification Status AWB811470484778.exe	29
PID 1008 wrote to memory of 1824	1008	DHL Shipment Notification Status AWB811470484778.exe	30
PID 1008 wrote to memory of 1824	1008	DHL Shipment Notification Status AWB811470484778.exe	30
PID 1008 wrote to memory of 1824	1008	DHL Shipment Notification Status AWB811470484778.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	DHL Shipment Notification Status AWB811470484778.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe
1008	DHL Shipment Notification Status AWB811470484778.exe

C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1008
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:1288
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:1824