456050b3b656fc30777d31163ef1677302f224c4d36bc43dff99ae91fec67d61

Analysis

Target
mannzx.exe
Size 37KB
Sample220314-ymactadghk
SHA256 456050b3b656fc30777d31163ef1677302f224c4d36bc43dff99ae91fec67d61
MD5 89acff9ec4590de79e9fb5c288f5adb0
SHA1 ceb8a931df9c18e5e555afabc92b2fbb0c9ab20a
SHA512 784191035890be46a75a64760c55004271451043f85f3422d8273d29e682adea05bb491014159a2def13fb8255a9cb5bd40d64f17bb15bda41b4c4ec4ab21a90
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	972	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	mannzx.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1740	972	mannzx.exe	27
PID 972 wrote to memory of 1740	972	mannzx.exe	27
PID 972 wrote to memory of 1740	972	mannzx.exe	27
PID 972 wrote to memory of 1740	972	mannzx.exe	27

C:\Users\Admin\AppData\Local\Temp\mannzx.exe
"C:\Users\Admin\AppData\Local\Temp\mannzx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 1128
  2⤵
  - Program crash
  PID:1740

memory/972-54-0x0000000000090000-0x000000000009E000-memory.dmp

Download

memory/972-55-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Download

memory/972-56-0x0000000075B01000-0x0000000075B03000-memory.dmp

Download

memory/972-57-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download