efbf5a969b67ed8197b94ea06b03876e6e5cd6853c339e922f59f4741f1a78f3 | Triage

Analysis

max time kernel
68s
max time network
119s
platform
windows10_x64
resource
win10
submitted
07-07-2020 08:37

Sharing

Report Analysis Logs

General

Target

Order Nr 1_04080 00066831 ADHISAKTI SOLUSI KOMPUTINDO.exe
Size

674KB
MD5

b21189906b103028dee0fb64b4a81a1a
SHA1

09ed479ac5de813a062c0b14210a98a506eb0401
SHA256

efbf5a969b67ed8197b94ea06b03876e6e5cd6853c339e922f59f4741f1a78f3
SHA512

b838a4d5962883bbb58463345d3af444a3ec443408ccc22f3e6397396d0549149037e3c785db1e8e334b7230a44bf7a1f38415744a66d852d0f1134e311c2de2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3972 3984 WerFault.exe Order Nr 1_04080 00066831 ADHISAKTI SOLUSI KOMPUTINDO.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3972 WerFault.exe
Token: SeBackupPrivilege 3972 WerFault.exe
Token: SeDebugPrivilege 3972 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order Nr 1_04080 00066831 ADHISAKTI SOLUSI KOMPUTINDO.exe
"C:\Users\Admin\AppData\Local\Temp\Order Nr 1_04080 00066831 ADHISAKTI SOLUSI KOMPUTINDO.exe"
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 936
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3972-0-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/3972-1-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download