Analysis
- max time kernel
117s - max time network
123s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
02/12/2021, 08:53
General
- Target DHL_AWB_NO#907853880911.exe
- Size 652KB
- Sample211202-ktb84adegp
- SHA256 928fa5212b0c021cfc133bf17ce791b9a12f627356a171ae1afa377fdbb3ca19
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 7042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1536-55-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/1536-57-0x00000000764D1000-0x00000000764D3000-memory.dmp
memory/1536-58-0x00000000045F0000-0x00000000045F1000-memory.dmp
memory/1536-59-0x0000000000530000-0x0000000000538000-memory.dmp
memory/1536-60-0x0000000005440000-0x00000000054CD000-memory.dmp
memory/1924-62-0x0000000000CA0000-0x0000000000CA1000-memory.dmp