456050b3b656fc30777d31163ef1677302f224c4d36bc43dff99ae91fec67d61 | Triage

Analysis

max time kernel
4294090s
max time network
14s
platform
windows7_x64
resource
win7-20220311-en
submitted
14-03-2022 19:53

Sharing

Report Analysis Logs

General

Target

mannzx.exe
Size

37KB
MD5

89acff9ec4590de79e9fb5c288f5adb0
SHA1

ceb8a931df9c18e5e555afabc92b2fbb0c9ab20a
SHA256

456050b3b656fc30777d31163ef1677302f224c4d36bc43dff99ae91fec67d61
SHA512

784191035890be46a75a64760c55004271451043f85f3422d8273d29e682adea05bb491014159a2def13fb8255a9cb5bd40d64f17bb15bda41b4c4ec4ab21a90

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 972 WerFault.exe mannzx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mannzx.exe

description pid process

Token: SeDebugPrivilege 972 mannzx.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

mannzx.exe

description	pid	process	target process
PID 972 wrote to memory of 1740	972	mannzx.exe	WerFault.exe
PID 972 wrote to memory of 1740	972	mannzx.exe	WerFault.exe
PID 972 wrote to memory of 1740	972	mannzx.exe	WerFault.exe
PID 972 wrote to memory of 1740	972	mannzx.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\mannzx.exe
"C:\Users\Admin\AppData\Local\Temp\mannzx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 1128
2⤵
- Program crash
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-54-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/972-55-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/972-56-0x0000000075B01000-0x0000000075B03000-memory.dmp

Filesize
8KB

Download
memory/972-57-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download