Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
af00f91df5feb2eab773d1d3ee632dee9ae6d53e67f74109bd531dcef25708f2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af00f91df5feb2eab773d1d3ee632dee9ae6d53e67f74109bd531dcef25708f2.exe
Resource
win10v2004-20220812-en
General
-
Target
af00f91df5feb2eab773d1d3ee632dee9ae6d53e67f74109bd531dcef25708f2.exe
-
Size
24KB
-
MD5
805e627d36590633248ad7d4f98551d4
-
SHA1
72e39be1b1f25df25622a04d615f009f6ced8e4e
-
SHA256
af00f91df5feb2eab773d1d3ee632dee9ae6d53e67f74109bd531dcef25708f2
-
SHA512
6de7f23c08d8422ad80a4f44159e19ca494cf788bd6f35262e3e1acae96af0f0ad9fb9cc37981e5567300119f725b42fb7dde55b39e6c43a6144154461dd99ae
-
SSDEEP
3:WlW7g//SRqEVFnrlltvl7//llrlly9/ldldt1l9tllFllJllPtllUlG99l//lpl4:iz3SsEu9/YM82eApxQsBORIBvuJKQmQ
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 64 3564 WerFault.exe 82 2028 3564 WerFault.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\af00f91df5feb2eab773d1d3ee632dee9ae6d53e67f74109bd531dcef25708f2.exe"C:\Users\Admin\AppData\Local\Temp\af00f91df5feb2eab773d1d3ee632dee9ae6d53e67f74109bd531dcef25708f2.exe"1⤵PID:3564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 2522⤵
- Program crash
PID:64
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 2642⤵
- Program crash
PID:2028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3564 -ip 35641⤵PID:5016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3564 -ip 35641⤵PID:4120