Analysis
-
max time kernel
128s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
19-10-2021 08:27
General
-
Target
DHL_1012617429350,pdf.exe
-
Size
230KB
-
MD5
5cab111e16c4473b848206291ddb2668
-
SHA1
64bb159114230467d5c56e9041e9270d2c2615f2
-
SHA256
4b64ebe81e55e2ed6e6317f516851fa1b52a3b94a7f139a61234aed6bcb97da2
-
SHA512
f2ac18a0a9f74580055ea60a4ffe54b664b10f1c89b31d6f92a59f0a27710bff874870dba412f0a1743aaf46721aa6ab51276729aeb3613dbd9b225a946b49a6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_1012617429350,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_1012617429350,pdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 16362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-57-0x0000000000000000-mapping.dmp
-
memory/516-58-0x0000000000540000-0x0000000000580000-memory.dmpFilesize
256KB
-
memory/1556-53-0x0000000001170000-0x0000000001171000-memory.dmpFilesize
4KB
-
memory/1556-55-0x00000000757B1000-0x00000000757B3000-memory.dmpFilesize
8KB
-
memory/1556-56-0x0000000001110000-0x0000000001111000-memory.dmpFilesize
4KB