Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    588s
  • max time network
    556s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2022, 14:14

General

  • Target

    Master3DRPG_beta(v.3.5.4)/Master3DRPG_v3.5.4.exe

  • Size

    700.1MB

  • MD5

    c3bc2bcdce7d92a82c6b5a8679aa5914

  • SHA1

    8a7ace913d835e66981939b76dc1903699333e86

  • SHA256

    82d8bb8a09bbd84a603c5c1d6d543ededece7492d51a80f6d55f5187bb547b15

  • SHA512

    d22b8ca7587a58009c652da6d41c8a7111151aa53e1d94da206fb18427aabc94a18df4494d0a08fa6dddd103d41ab585713b09a5b0548446351986ebfa0f9f00

  • SSDEEP

    1536:LZvXriaCwQJ2DN2K2mW1kVl943EAfmTwHSHtQcJR6QA:hWr2DN2x1kVsiwyNQcJR6QA

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe
      "C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe"
      2⤵
        PID:4920
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 740
          3⤵
          • Program crash
          PID:3728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4920 -ip 4920
      1⤵
        PID:3172

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4920-136-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/4920-138-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/4920-139-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/4920-140-0x0000000005840000-0x0000000005B01000-memory.dmp

        Filesize

        2.8MB

      • memory/4920-141-0x0000000005840000-0x0000000005B01000-memory.dmp

        Filesize

        2.8MB

      • memory/4920-142-0x0000000005840000-0x0000000005B01000-memory.dmp

        Filesize

        2.8MB

      • memory/4972-132-0x00000000004F0000-0x000000000050C000-memory.dmp

        Filesize

        112KB

      • memory/4972-133-0x0000000005340000-0x00000000058E4000-memory.dmp

        Filesize

        5.6MB

      • memory/4972-134-0x0000000004E60000-0x0000000004EC6000-memory.dmp

        Filesize

        408KB