dd208244eb1a5fd616173f4dd0ed419bcfc360c5c3237eb0510b4f97fa22b72d

Analysis

max time kernel
48s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/04/2023, 05:20

Target

DHL6782282.exe
Size

757KB
MD5

57b4778fbb5d3dcb29ee57b459c4c0f0
SHA1

e8a5388bda35c0ea02de38c79751232d156177f6
SHA256

dd208244eb1a5fd616173f4dd0ed419bcfc360c5c3237eb0510b4f97fa22b72d
SHA512

1384581a13e46951905033eacfd6e1e67b24c9260534bece992f0ed7a802867f2e6b4aa3b41f760ecb29e4e16f18fc1410d6ff646f9b109a2eb20f25f9b41774
SSDEEP

12288:DDiv0S6EHMH91DzZBwuAXaVxpceJ4Sudqtvuf+kDk8iQdZ6xhraLH0DT:DlBEHMd1DtBOaTKUtvuGEpXLHWT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	284	DHL6782282.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 284 wrote to memory of 1284	284	DHL6782282.exe	28
PID 284 wrote to memory of 1284	284	DHL6782282.exe	28
PID 284 wrote to memory of 1284	284	DHL6782282.exe	28
PID 284 wrote to memory of 1284	284	DHL6782282.exe	28
PID 284 wrote to memory of 688	284	DHL6782282.exe	29
PID 284 wrote to memory of 688	284	DHL6782282.exe	29
PID 284 wrote to memory of 688	284	DHL6782282.exe	29
PID 284 wrote to memory of 688	284	DHL6782282.exe	29
PID 284 wrote to memory of 1180	284	DHL6782282.exe	30
PID 284 wrote to memory of 1180	284	DHL6782282.exe	30
PID 284 wrote to memory of 1180	284	DHL6782282.exe	30
PID 284 wrote to memory of 1180	284	DHL6782282.exe	30
PID 284 wrote to memory of 536	284	DHL6782282.exe	31
PID 284 wrote to memory of 536	284	DHL6782282.exe	31
PID 284 wrote to memory of 536	284	DHL6782282.exe	31
PID 284 wrote to memory of 536	284	DHL6782282.exe	31
PID 284 wrote to memory of 440	284	DHL6782282.exe	32
PID 284 wrote to memory of 440	284	DHL6782282.exe	32
PID 284 wrote to memory of 440	284	DHL6782282.exe	32
PID 284 wrote to memory of 440	284	DHL6782282.exe	32

C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe
"C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:284
- C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe"
  2⤵
  PID:1284
- C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe"
  2⤵
  PID:688
- C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe"
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe"
  2⤵
  PID:536
- C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL6782282.exe"
  2⤵
  PID:440

memory/284-54-0x0000000000390000-0x0000000000454000-memory.dmp

Filesize
784KB

Download
memory/284-55-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/284-56-0x0000000000680000-0x0000000000694000-memory.dmp

Filesize
80KB

Download
memory/284-57-0x0000000000690000-0x000000000069C000-memory.dmp

Filesize
48KB

Download
memory/284-58-0x0000000005E10000-0x0000000005E84000-memory.dmp

Filesize
464KB

Download
memory/284-59-0x00000000021A0000-0x00000000021DC000-memory.dmp

Filesize
240KB

Download