9e955a45b4cfc93907301667eb452539354da528fafdcaeb45da78a7388981cf

Analysis

Target
DHL Draft Copy.exe
Size 975KB
Sample201211-d1c47p4xkn
SHA256 9e955a45b4cfc93907301667eb452539354da528fafdcaeb45da78a7388981cf
MD5 8ee2e2ab11a4628ff7bfd7238c87bd71
SHA1 58cc9c208824d8d035c79faf4035c6ade3f16840
SHA512 34cfe0d1fba0be11e4820fad49f4b6276dc2a7bd1a1ad6617c5f9bf488ba8800abe179193f5d6ca2e7253c1fc45f9438e8480328694b91e80696bc70be7a348b
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	1204	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1564	1204	DHL Draft Copy.exe	29
PID 1204 wrote to memory of 1564	1204	DHL Draft Copy.exe	29
PID 1204 wrote to memory of 1564	1204	DHL Draft Copy.exe	29
PID 1204 wrote to memory of 1564	1204	DHL Draft Copy.exe	29

C:\Users\Admin\AppData\Local\Temp\DHL Draft Copy.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Draft Copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 876
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1564

memory/1204-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/1204-3-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/1204-5-0x0000000006E30000-0x0000000006F06000-memory.dmp

Download

memory/1204-6-0x0000000000460000-0x000000000046E000-memory.dmp

Download

memory/1204-7-0x0000000000490000-0x0000000000495000-memory.dmp

Download

memory/1564-10-0x00000000008A0000-0x00000000008B1000-memory.dmp

Download

memory/1564-13-0x00000000026C0000-0x00000000026D1000-memory.dmp

Download