Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    185s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 08:14

General

  • Target

    892d47104f381986aaf02021170c4ef1d74f8bb81bbd76687e812281cacfe642.exe

  • Size

    239KB

  • MD5

    1149c533e925e21690618fae6c60dea3

  • SHA1

    db5c64dd5b0d4c9b44e98d1cb2c9768eac8d65a5

  • SHA256

    892d47104f381986aaf02021170c4ef1d74f8bb81bbd76687e812281cacfe642

  • SHA512

    aaa48a530244b68c763bb29ff9b422b10fb8846e3fdf6f66808381acea1657696bdffb374cbbab71b2e0df2812715abd5a76cb92deb562f7c33ab033013e47e8

  • SSDEEP

    6144:OgL4kGvQEIrSQqfxCs8pcPbe7DfLn/s/:OEkQEMqfkLXrA

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\892d47104f381986aaf02021170c4ef1d74f8bb81bbd76687e812281cacfe642.exe
    "C:\Users\Admin\AppData\Local\Temp\892d47104f381986aaf02021170c4ef1d74f8bb81bbd76687e812281cacfe642.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 300
      2⤵
      • Program crash
      PID:4876
    • C:\Users\Admin\AppData\Local\Temp\892d47104f381986aaf02021170c4ef1d74f8bb81bbd76687e812281cacfe642.exe
      "C:\Users\Admin\AppData\Local\Temp\892d47104f381986aaf02021170c4ef1d74f8bb81bbd76687e812281cacfe642.exe"
      2⤵
        PID:5024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 152
        2⤵
        • Program crash
        PID:4616
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2040 -ip 2040
      1⤵
        PID:3088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2040 -ip 2040
        1⤵
          PID:3284

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2040-132-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/2040-140-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/5024-134-0x0000000000400000-0x000000000043B000-memory.dmp

          Filesize

          236KB

        • memory/5024-135-0x0000000000400000-0x000000000043B000-memory.dmp

          Filesize

          236KB

        • memory/5024-136-0x0000000000400000-0x000000000043B000-memory.dmp

          Filesize

          236KB

        • memory/5024-139-0x0000000000400000-0x000000000043B000-memory.dmp

          Filesize

          236KB

        • memory/5024-141-0x0000000000400000-0x000000000043B000-memory.dmp

          Filesize

          236KB