Analysis
-
max time kernel
38s -
max time network
52s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 14:05
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipment Notification Status AWB811470484778.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL Shipment Notification Status AWB811470484778.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
DHL Shipment Notification Status AWB811470484778.exe
-
Size
458KB
-
MD5
644bfd229ad251d58b39c3b2c48ac4a5
-
SHA1
be354ee15cf727285b933ec6646299725fc3c918
-
SHA256
095d9489f869a9b368679cf2f9aa49f3085b360bd9b36e9d49050821e0b83e87
-
SHA512
f201f9d7510ceb03bc9a3233a850f7a340fa3e0b07e4463859dd41b1b7dc3ec2f3408a432f561c8ae88e102e52c0c7531f47b552292f69a96eabd87ccb2764d1
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
DHL Shipment Notification Status AWB811470484778.exedescription pid process target process PID 1388 wrote to memory of 736 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 736 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 736 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1056 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1056 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1056 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1052 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1052 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1052 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1044 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1044 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1044 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1040 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1040 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe PID 1388 wrote to memory of 1040 1388 DHL Shipment Notification Status AWB811470484778.exe DHL Shipment Notification Status AWB811470484778.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DHL Shipment Notification Status AWB811470484778.exedescription pid process Token: SeDebugPrivilege 1388 DHL Shipment Notification Status AWB811470484778.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
DHL Shipment Notification Status AWB811470484778.exepid process 1388 DHL Shipment Notification Status AWB811470484778.exe 1388 DHL Shipment Notification Status AWB811470484778.exe 1388 DHL Shipment Notification Status AWB811470484778.exe 1388 DHL Shipment Notification Status AWB811470484778.exe 1388 DHL Shipment Notification Status AWB811470484778.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"{path}"2⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"{path}"2⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"{path}"2⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"{path}"2⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification Status AWB811470484778.exe"{path}"2⤵PID:1040