40134b68bf863594a5a030a9c961a4b87b405424ecaf4c8df7de7e47811f30c8 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 06:10

Sharing

Report Analysis Logs

General

Target

mrr.exe
Size

364KB
MD5

20ed4eced64d1b806ceb823c135d1d33
SHA1

88afb4f4c0490d8ab1a2c7f31f5e5f5114d4b70d
SHA256

40134b68bf863594a5a030a9c961a4b87b405424ecaf4c8df7de7e47811f30c8
SHA512

8c1810f16ea1822130774741d1c4b8789aaec50d0a2f5db60e263a154c488b065ca2f427b7b76b74da7a6742aa0fe6f282275199a53f27803128db811f8fac8e
SSDEEP

6144:MmBy5jGDw2bay5eLOi6+zgH6561uOlMH9O1BNI:MQy5jGfbaDaza561XlMo7I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2656	2640	mrr.exe	31
PID 2640 wrote to memory of 2656	2640	mrr.exe	31
PID 2640 wrote to memory of 2656	2640	mrr.exe	31

C:\Users\Admin\AppData\Local\Temp\mrr.exe
"C:\Users\Admin\AppData\Local\Temp\mrr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2640 -s 32
  2⤵
  PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads