2bdddf286d7d4a828edab0a6669e06e208f020e70e6ead03c54a95b371c42bf4

Analysis

max time kernel
60s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/08/2022, 08:41

Target
DHL AWB TRACKING DETAILS.exe
Size 815KB
Sample220825-klfasabce2
SHA256 2bdddf286d7d4a828edab0a6669e06e208f020e70e6ead03c54a95b371c42bf4
MD5 7e96d18fbc04c92de4a55bcac86a8d37
SHA1 54ba2138aa4adaa56e8fdbac6cd6cd3fd0c3097e
SHA512 3fcd8df5f4455d6faada9e527e275ecbb6e0aab95626c6a58cf00b6223ce1fb42f04c790c532406de103b82c43d952ce19dd027e39d53f5d8ec048cb8c9fda02
SSDEEP 24576:iqzT/0shbH11T/0shbuP+SS4VaHRdrcNY/yfA2/ghn:9R55b4aRFcN3gF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	DHL AWB TRACKING DETAILS.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1200	1916	DHL AWB TRACKING DETAILS.exe	26
PID 1916 wrote to memory of 1200	1916	DHL AWB TRACKING DETAILS.exe	26
PID 1916 wrote to memory of 1200	1916	DHL AWB TRACKING DETAILS.exe	26
PID 1916 wrote to memory of 1200	1916	DHL AWB TRACKING DETAILS.exe	26
PID 1916 wrote to memory of 968	1916	DHL AWB TRACKING DETAILS.exe	27
PID 1916 wrote to memory of 968	1916	DHL AWB TRACKING DETAILS.exe	27
PID 1916 wrote to memory of 968	1916	DHL AWB TRACKING DETAILS.exe	27
PID 1916 wrote to memory of 968	1916	DHL AWB TRACKING DETAILS.exe	27
PID 1916 wrote to memory of 1648	1916	DHL AWB TRACKING DETAILS.exe	28
PID 1916 wrote to memory of 1648	1916	DHL AWB TRACKING DETAILS.exe	28
PID 1916 wrote to memory of 1648	1916	DHL AWB TRACKING DETAILS.exe	28
PID 1916 wrote to memory of 1648	1916	DHL AWB TRACKING DETAILS.exe	28
PID 1916 wrote to memory of 1588	1916	DHL AWB TRACKING DETAILS.exe	29
PID 1916 wrote to memory of 1588	1916	DHL AWB TRACKING DETAILS.exe	29
PID 1916 wrote to memory of 1588	1916	DHL AWB TRACKING DETAILS.exe	29
PID 1916 wrote to memory of 1588	1916	DHL AWB TRACKING DETAILS.exe	29
PID 1916 wrote to memory of 1728	1916	DHL AWB TRACKING DETAILS.exe	30
PID 1916 wrote to memory of 1728	1916	DHL AWB TRACKING DETAILS.exe	30
PID 1916 wrote to memory of 1728	1916	DHL AWB TRACKING DETAILS.exe	30
PID 1916 wrote to memory of 1728	1916	DHL AWB TRACKING DETAILS.exe	30

C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"
  2⤵
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"
  2⤵
  PID:968
- C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"
  2⤵
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"
  2⤵
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"
  2⤵
  PID:1728

memory/1916-54-0x00000000000C0000-0x0000000000192000-memory.dmp

Download

memory/1916-55-0x00000000759E1000-0x00000000759E3000-memory.dmp

Download

memory/1916-56-0x0000000000430000-0x000000000044A000-memory.dmp

Download

memory/1916-57-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/1916-58-0x0000000005D80000-0x0000000005E0A000-memory.dmp

Download

memory/1916-59-0x0000000002010000-0x000000000204A000-memory.dmp

Download