0f646539e424b78145f10890170c52f952ef950c3530b3b36979ea805d1c3b22 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 08:37

Sharing

Report Analysis Logs

General

Target

DHL EXPRESS.exe
Size

1.1MB
MD5

7bc30d8e9682aa4832cc11276c802d43
SHA1

344101f20049c6c9ebc082a8db3d398006a1a8bb
SHA256

0f646539e424b78145f10890170c52f952ef950c3530b3b36979ea805d1c3b22
SHA512

0d3afa12c8050ed2da39d34b549ff4cfd4a750e638796bedafd0c824c53f7b33e4faa97c3f053a0e1de9670edf2a2aa61106e2e55244f133421f51bae9b166a7
SSDEEP

24576:Q0QxU0g8+jwId+JTqovW4Ts3vCNaLe3gRuzh:Qg8GL4TRvW+0a8L4g0zh

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DHL EXPRESS.exe

description pid process

Token: SeDebugPrivilege 2972 DHL EXPRESS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DHL EXPRESS.exe

description	pid	process	target process
PID 2972 wrote to memory of 2180	2972	DHL EXPRESS.exe	WerFault.exe
PID 2972 wrote to memory of 2180	2972	DHL EXPRESS.exe	WerFault.exe
PID 2972 wrote to memory of 2180	2972	DHL EXPRESS.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL EXPRESS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL EXPRESS.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2972 -s 540
2⤵
PID:2180

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x0000000000E90000-0x0000000000F18000-memory.dmp

Filesize
544KB

Download
memory/2972-1-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-2-0x000000001B280000-0x000000001B300000-memory.dmp

Filesize
512KB

Download
memory/2972-3-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download