Analysis
- max time kernel
53s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/12/2020, 11:05
General
- Target DHL Draft Copy.exe
- Size 975KB
- Sample201211-d1c47p4xkn
- SHA256 9e955a45b4cfc93907301667eb452539354da528fafdcaeb45da78a7388981cf
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Draft Copy.exe"C:\Users\Admin\AppData\Local\Temp\DHL Draft Copy.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 14082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/652-3-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/652-5-0x0000000007360000-0x0000000007436000-memory.dmp
memory/652-6-0x0000000007940000-0x0000000007941000-memory.dmp
memory/652-7-0x0000000007440000-0x0000000007441000-memory.dmp
memory/652-8-0x0000000007520000-0x0000000007521000-memory.dmp
memory/652-9-0x000000000AE40000-0x000000000AE41000-memory.dmp
memory/652-10-0x000000000A9F0000-0x000000000A9F1000-memory.dmp
memory/652-11-0x000000000AB10000-0x000000000AB1E000-memory.dmp
memory/652-12-0x0000000008F80000-0x0000000008F85000-memory.dmp
memory/1340-14-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/1340-15-0x00000000054C0000-0x00000000054C1000-memory.dmp