7abe87a6b675d3601a4014ac6da84392442159a68992ce0b24e709d4a1d20690 | Triage

Analysis

max time kernel
257s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2022, 07:33

Sharing

Report Analysis Logs

General

Target

Your DHL Shipment Notification.pdf.exe
Size

496KB
MD5

6f7302e24899d1c05dcabbc8ec3e84d4
SHA1

11a5cbb08fc5698fd3bf3fd086ba0fcd954ecdec
SHA256

7abe87a6b675d3601a4014ac6da84392442159a68992ce0b24e709d4a1d20690
SHA512

2e9a1dd072c835a499ad6bcb30e314c19ad51057555bcde839d466da72e3816fb320bb2b076c43fa484e59a5f36cc4e8da01fa49d501006fb178f3510d83f368

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	4100	WerFault.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
560	Your DHL Shipment Notification.pdf.exe

C:\Users\Admin\AppData\Local\Temp\Your DHL Shipment Notification.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Your DHL Shipment Notification.pdf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 4100 -ip 4100
1⤵
PID:4992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4100 -s 772
1⤵
- Program crash
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads