7883350c84d207aed417d87b01cf9bf6b42ef14c8b6ad5a2d9012ee48cc3665d | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/09/2022, 15:46

Sharing

Report Analysis Logs

General

Target

DHL AWB SHIPMENT DOCUMENTS.exe
Size

29KB
MD5

835eef5f841c9c518310970f01d6cf15
SHA1

1409d67b4da3bb63121bb20df97a109e656ec4f7
SHA256

7883350c84d207aed417d87b01cf9bf6b42ef14c8b6ad5a2d9012ee48cc3665d
SHA512

b6c739396f700a6c7585b9fb00800857317078b43a805dcb9e2ca0d1027db713ced0f9d794396ae1ae9e1ad28e966902fb5e0c8b6b2bd98c32cfb53520becb50
SSDEEP

768:MgS93Y3kmoIqZya4zM2fxwtxJB0ZLmIQ0:MX6oIvJzdwvJBkG0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	2032	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	DHL AWB SHIPMENT DOCUMENTS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1732	2032	DHL AWB SHIPMENT DOCUMENTS.exe	27
PID 2032 wrote to memory of 1732	2032	DHL AWB SHIPMENT DOCUMENTS.exe	27
PID 2032 wrote to memory of 1732	2032	DHL AWB SHIPMENT DOCUMENTS.exe	27
PID 2032 wrote to memory of 1732	2032	DHL AWB SHIPMENT DOCUMENTS.exe	27

C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENT DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENT DOCUMENTS.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1112
  2⤵
  - Program crash
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000000D20000-0x0000000000D2C000-memory.dmp

Filesize
48KB

Download
memory/2032-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download