8206e029f0266ea051b039afc8b9427f70079ee9d9ba4cb7cacd9f944fd2e9c2

Analysis

max time kernel
46s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 09:30

Target

DHL Notification_pdf.exe
Size

572KB
MD5

5d0704142349c70304df4a3e2a401d6b
SHA1

d8c0caf793b78713ac02dcd09e0e326d6bd45b18
SHA256

8206e029f0266ea051b039afc8b9427f70079ee9d9ba4cb7cacd9f944fd2e9c2
SHA512

bcd473e62bdbf5162b300575f41c2a9e3e008d3ed8a34dc875fb81618cddb8b55d1656a050b176d9f7a173dcb93ae0bf753aaaa738b82f98bc3978ee2606456d
SSDEEP

12288:th7vEV0mHpuSvMvEahAaWP7IneAdvB3RwkdK0t95/KLEyLONLb/:kPTaGknvvB3Rwko0P52EyLO

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	DHL Notification_pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1996	1764	DHL Notification_pdf.exe	28
PID 1764 wrote to memory of 1996	1764	DHL Notification_pdf.exe	28
PID 1764 wrote to memory of 1996	1764	DHL Notification_pdf.exe	28
PID 1764 wrote to memory of 1996	1764	DHL Notification_pdf.exe	28
PID 1764 wrote to memory of 1500	1764	DHL Notification_pdf.exe	29
PID 1764 wrote to memory of 1500	1764	DHL Notification_pdf.exe	29
PID 1764 wrote to memory of 1500	1764	DHL Notification_pdf.exe	29
PID 1764 wrote to memory of 1500	1764	DHL Notification_pdf.exe	29
PID 1764 wrote to memory of 1520	1764	DHL Notification_pdf.exe	30
PID 1764 wrote to memory of 1520	1764	DHL Notification_pdf.exe	30
PID 1764 wrote to memory of 1520	1764	DHL Notification_pdf.exe	30
PID 1764 wrote to memory of 1520	1764	DHL Notification_pdf.exe	30
PID 1764 wrote to memory of 1508	1764	DHL Notification_pdf.exe	31
PID 1764 wrote to memory of 1508	1764	DHL Notification_pdf.exe	31
PID 1764 wrote to memory of 1508	1764	DHL Notification_pdf.exe	31
PID 1764 wrote to memory of 1508	1764	DHL Notification_pdf.exe	31
PID 1764 wrote to memory of 1164	1764	DHL Notification_pdf.exe	32
PID 1764 wrote to memory of 1164	1764	DHL Notification_pdf.exe	32
PID 1764 wrote to memory of 1164	1764	DHL Notification_pdf.exe	32
PID 1764 wrote to memory of 1164	1764	DHL Notification_pdf.exe	32

C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"
  2⤵
  PID:1508
- C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"
  2⤵
  PID:1164

memory/1764-54-0x00000000003C0000-0x0000000000454000-memory.dmp

Filesize
592KB

Download
memory/1764-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1764-56-0x00000000005E0000-0x00000000005F8000-memory.dmp

Filesize
96KB

Download
memory/1764-57-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/1764-58-0x0000000007360000-0x00000000073D0000-memory.dmp

Filesize
448KB

Download
memory/1764-59-0x0000000000690000-0x00000000006C6000-memory.dmp

Filesize
216KB

Download