feb7300da45537d68546b3e17b29a589450fc8422cd386dafd5410365fb5128b

Analysis

max time kernel
212s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHLDOCUMENTS27011222.exe
Size

838KB
MD5

58077ced076708815fa29dd0868d99e2
SHA1

f8d7f9c739c8c30efea7ee7e8a05a33319b0dd79
SHA256

e7b95197fb910258fc23e03856af901ad54e0e824a707b5605a275296c85dc40
SHA512

1e99132d9b2ecbadd21d9c81e993ad4741f4fb1f95c62a38b0848b449fec88d147ee0455e23495c4e4f4741f12c08bf14767280b7815e2f768e0ff3ff6c4d6ef
SSDEEP

24576:VC1Gudz+ZoRu+VI1SBllryZcZhaUIgvpjRpY:VTudquRuz1SBbyWaZgxjb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

DHLDOCUMENTS27011222.exe

pid process

540 DHLDOCUMENTS27011222.exe
540 DHLDOCUMENTS27011222.exe
540 DHLDOCUMENTS27011222.exe
540 DHLDOCUMENTS27011222.exe
540 DHLDOCUMENTS27011222.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DHLDOCUMENTS27011222.exe

description pid process

Token: SeDebugPrivilege 540 DHLDOCUMENTS27011222.exe

pid	process
540	DHLDOCUMENTS27011222.exe
540	DHLDOCUMENTS27011222.exe
540	DHLDOCUMENTS27011222.exe
540	DHLDOCUMENTS27011222.exe
540	DHLDOCUMENTS27011222.exe

description	pid	process
Token: SeDebugPrivilege	540	DHLDOCUMENTS27011222.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

DHLDOCUMENTS27011222.exe

description	pid	process	target process
PID 540 wrote to memory of 1760	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1760	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1760	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1760	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 728	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 728	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 728	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 728	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1280	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1280	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1280	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1280	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1916	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1916	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1916	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1916	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1292	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1292	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1292	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe
PID 540 wrote to memory of 1292	540	DHLDOCUMENTS27011222.exe	DHLDOCUMENTS27011222.exe

C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe
"C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe
"C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe"
2⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe
"C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe"
2⤵
PID:728

C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe
"C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe"
2⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe
"C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe"
2⤵
PID:1916

C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe
"C:\Users\Admin\AppData\Local\Temp\DHLDOCUMENTS27011222.exe"
2⤵
PID:1292

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-54-0x00000000003C0000-0x0000000000498000-memory.dmp

Filesize
864KB

Download
memory/540-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/540-56-0x0000000000240000-0x0000000000256000-memory.dmp

Filesize
88KB

Download
memory/540-57-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/540-58-0x0000000007E50000-0x0000000007EC4000-memory.dmp

Filesize
464KB

Download
memory/540-59-0x0000000000A30000-0x0000000000A6E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads