Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows10_x64 -
resource
win10 -
submitted
13/07/2020, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
-
Size
742KB
-
MD5
0546a5de3ee0d82d42e87c6032326b18
-
SHA1
46a7470e3011775d6a704f6a1a9c2cb74e0b1ff5
-
SHA256
1b63db723d1957b88d6199fb5ea958f28de43333d2482a137c5b73b8be78a4a0
-
SHA512
8b13507141d4fd345e55356f0f5244b0de6fa065965e20eb57520932bf6c9a5cfb15c3a700e16d0a1ae783037f2402a5a2aed1d4695ad233611cd85b7d43695b
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3840 3104 WerFault.exe 66 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3840 WerFault.exe Token: SeBackupPrivilege 3840 WerFault.exe Token: SeDebugPrivilege 3840 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe 3840 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"1⤵PID:3104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 11362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3840
-