f880a368ea47e34a5f39d521ddbbb65a0aa0697249b8549cd7d6dca3dfcc89a6

Analysis

max time kernel
47s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/09/2022, 10:00

Target
FedEx Shipment documents.exe
Size 993KB
Sample220927-l1pcnsdbe7
SHA256 f880a368ea47e34a5f39d521ddbbb65a0aa0697249b8549cd7d6dca3dfcc89a6
MD5 fc16dc349b7942b56afabdba0dac16ac
SHA1 46228bf137baa71dce15d40ed8088310b00e1280
SHA512 8d37aeada29098c973042836ec42d42a8c88c3011e50e68586cadae0fc2058b27af7288c97abc9509bf5cda5bc2bc061674e2713040d946064b7530be1432c69
SSDEEP 24576:Pq2Mo1x5UMjiR9F8KT7klIuTti7GTNdqQF:PqIf5r+kSuTqGd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1944	FedEx Shipment documents.exe
1944	FedEx Shipment documents.exe
1944	FedEx Shipment documents.exe
1944	FedEx Shipment documents.exe
1944	FedEx Shipment documents.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	FedEx Shipment documents.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1312	1944	FedEx Shipment documents.exe	27
PID 1944 wrote to memory of 1312	1944	FedEx Shipment documents.exe	27
PID 1944 wrote to memory of 1312	1944	FedEx Shipment documents.exe	27
PID 1944 wrote to memory of 1312	1944	FedEx Shipment documents.exe	27
PID 1944 wrote to memory of 1356	1944	FedEx Shipment documents.exe	28
PID 1944 wrote to memory of 1356	1944	FedEx Shipment documents.exe	28
PID 1944 wrote to memory of 1356	1944	FedEx Shipment documents.exe	28
PID 1944 wrote to memory of 1356	1944	FedEx Shipment documents.exe	28
PID 1944 wrote to memory of 1744	1944	FedEx Shipment documents.exe	29
PID 1944 wrote to memory of 1744	1944	FedEx Shipment documents.exe	29
PID 1944 wrote to memory of 1744	1944	FedEx Shipment documents.exe	29
PID 1944 wrote to memory of 1744	1944	FedEx Shipment documents.exe	29
PID 1944 wrote to memory of 1708	1944	FedEx Shipment documents.exe	30
PID 1944 wrote to memory of 1708	1944	FedEx Shipment documents.exe	30
PID 1944 wrote to memory of 1708	1944	FedEx Shipment documents.exe	30
PID 1944 wrote to memory of 1708	1944	FedEx Shipment documents.exe	30
PID 1944 wrote to memory of 944	1944	FedEx Shipment documents.exe	31
PID 1944 wrote to memory of 944	1944	FedEx Shipment documents.exe	31
PID 1944 wrote to memory of 944	1944	FedEx Shipment documents.exe	31
PID 1944 wrote to memory of 944	1944	FedEx Shipment documents.exe	31

C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe
"C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe"
  2⤵
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe"
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe"
  2⤵
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe"
  2⤵
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment documents.exe"
  2⤵
  PID:944

memory/1944-54-0x0000000000210000-0x000000000030E000-memory.dmp

Download

memory/1944-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Download

memory/1944-56-0x0000000000500000-0x0000000000514000-memory.dmp

Download

memory/1944-57-0x0000000000510000-0x000000000051C000-memory.dmp

Download

memory/1944-58-0x00000000059E0000-0x0000000005A9A000-memory.dmp

Download

memory/1944-59-0x0000000004320000-0x0000000004382000-memory.dmp

Download