095d9489f869a9b368679cf2f9aa49f3085b360bd9b36e9d49050821e0b83e87

Analysis

Target

DHL Shipment Notification Status AWB811470484778.exe
Size

458KB
MD5

644bfd229ad251d58b39c3b2c48ac4a5
SHA1

be354ee15cf727285b933ec6646299725fc3c918
SHA256

095d9489f869a9b368679cf2f9aa49f3085b360bd9b36e9d49050821e0b83e87
SHA512

f201f9d7510ceb03bc9a3233a850f7a340fa3e0b07e4463859dd41b1b7dc3ec2f3408a432f561c8ae88e102e52c0c7531f47b552292f69a96eabd87ccb2764d1

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3520	4048	DHL Shipment Notification Status AWB811470484778.exe	67
PID 4048 wrote to memory of 3520	4048	DHL Shipment Notification Status AWB811470484778.exe	67
PID 4048 wrote to memory of 3836	4048	DHL Shipment Notification Status AWB811470484778.exe	68
PID 4048 wrote to memory of 3836	4048	DHL Shipment Notification Status AWB811470484778.exe	68
PID 4048 wrote to memory of 3840	4048	DHL Shipment Notification Status AWB811470484778.exe	69
PID 4048 wrote to memory of 3840	4048	DHL Shipment Notification Status AWB811470484778.exe	69
PID 4048 wrote to memory of 3828	4048	DHL Shipment Notification Status AWB811470484778.exe	70
PID 4048 wrote to memory of 3828	4048	DHL Shipment Notification Status AWB811470484778.exe	70
PID 4048 wrote to memory of 3860	4048	DHL Shipment Notification Status AWB811470484778.exe	71
PID 4048 wrote to memory of 3860	4048	DHL Shipment Notification Status AWB811470484778.exe	71

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	DHL Shipment Notification Status AWB811470484778.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe
4048	DHL Shipment Notification Status AWB811470484778.exe

C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4048
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:3836
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:3840
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:3828
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe
  "{path}"
  2⤵
  PID:3860