46022e409c51a232e3c38c24aa6d18070a3e8922293eb45bfade87a6dd69e358 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 12:41

Sharing

Report Analysis Logs

General

Target

MRP7.NET_GRP.exe
Size

58KB
MD5

19379edc89d5ea40eccc68917329829e
SHA1

aecb407ab920734a2205ce3c6c4c64dedae6f49b
SHA256

46022e409c51a232e3c38c24aa6d18070a3e8922293eb45bfade87a6dd69e358
SHA512

21ab9b7c1b9c320e68a43802d73288e52adf0227258ac98735082cd5a56cd7d21635458d1f18f12ceeae600abd7ae20dc1812dc7784fc307b1815c2ddb3b65b2
SSDEEP

768:b/GtjApAiojlQBkiwggz+U4gLFxk9/y+HIlWXCLwvPYX3xioa3UXpU:byioCBX7q4gL3k5HtXCSPOXOip

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2452	2800	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2452	2800	MRP7.NET_GRP.exe	1
PID 2800 wrote to memory of 2452	2800	MRP7.NET_GRP.exe	1
PID 2800 wrote to memory of 2452	2800	MRP7.NET_GRP.exe	1

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2800 -s 536
1⤵
- Program crash
PID:2452

C:\Users\Admin\AppData\Local\Temp\MRP7.NET_GRP.exe
"C:\Users\Admin\AppData\Local\Temp\MRP7.NET_GRP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-54-0x000007FEF6290000-0x000007FEF6C7C000-memory.dmp

Filesize
9.9MB

Download
memory/2800-53-0x0000000000CE0000-0x0000000000CF4000-memory.dmp

Filesize
80KB

Download
memory/2800-55-0x000007FEF6290000-0x000007FEF6C7C000-memory.dmp

Filesize
9.9MB

Download