5193184cceeb7785142ebd8770280a449fbe811fcbdfa5c7672116e69f8897b6

Analysis

max time kernel
47s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 13:15

Target

AWB DHL SHIPMENT DOCS.exe
Size

16KB
MD5

e22a17f2fd4f98c0508f50b6ab8d1948
SHA1

6a185691aa74ed5f769c09faaa59d2f9ec5e04ac
SHA256

5193184cceeb7785142ebd8770280a449fbe811fcbdfa5c7672116e69f8897b6
SHA512

dde9660a4e3b6905833ac914b2ca3a2e400a00363b4dd1c46c2383c3461e1bbde016876f4c390272757ce629f07acbc1d189f98d86b70686c07ae8c65dfd7d89
SSDEEP

192:6Z+wT4vLHkLF5hyfC+M2oA9irN9hJethjFUTUQdIunJvTLq7BbVc2Nk9G74ldV7:6FPLF5hX+wc5ULdIuJ7m7hm2NCyQV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

460 1444 WerFault.exe AWB DHL SHIPMENT DOCS.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AWB DHL SHIPMENT DOCS.exe

description pid process

Token: SeDebugPrivilege 1444 AWB DHL SHIPMENT DOCS.exe

pid	pid_target	process	target process
460	1444	WerFault.exe	AWB DHL SHIPMENT DOCS.exe

description	pid	process
Token: SeDebugPrivilege	1444	AWB DHL SHIPMENT DOCS.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

AWB DHL SHIPMENT DOCS.exe

description	pid	process	target process
PID 1444 wrote to memory of 460	1444	AWB DHL SHIPMENT DOCS.exe	WerFault.exe
PID 1444 wrote to memory of 460	1444	AWB DHL SHIPMENT DOCS.exe	WerFault.exe
PID 1444 wrote to memory of 460	1444	AWB DHL SHIPMENT DOCS.exe	WerFault.exe
PID 1444 wrote to memory of 460	1444	AWB DHL SHIPMENT DOCS.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 1084
2⤵
- Program crash
PID:460

memory/460-56-0x0000000000000000-mapping.dmp

Download
memory/1444-54-0x00000000009F0000-0x00000000009FA000-memory.dmp

Filesize
40KB

Download
memory/1444-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download