Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
da52f36dff2d572303b1e730b4a5702f050ca2a122c2f33e33d75b4c78dd09d7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
da52f36dff2d572303b1e730b4a5702f050ca2a122c2f33e33d75b4c78dd09d7.exe
Resource
win10v2004-20220812-en
General
-
Target
da52f36dff2d572303b1e730b4a5702f050ca2a122c2f33e33d75b4c78dd09d7.exe
-
Size
809KB
-
MD5
0903229bbb635fcc93ec0e03148c3fb0
-
SHA1
6d9a8e41b18fcdeb15df52a0dd56404c9ffefe9a
-
SHA256
da52f36dff2d572303b1e730b4a5702f050ca2a122c2f33e33d75b4c78dd09d7
-
SHA512
bd73f15bd264cb9063ad669e5c6b4a6476642e87ab1072c61f972e05505fb34b32bfbc81e82e8b872bd38f7177bac35be3fc75e6938df14ab7f234a3c097c1bf
-
SSDEEP
12288:2N+tozVM/WRnHQ8Fj3eKi5ueAp71WgNKTuWrHDVwf1IvZjTPZ9WO3kuLWr9JoT8:htWRnwrKPXN1zKyWTmOv9Th9+my9+
Malware Config
Signatures
-
Program crash 3 IoCs
pid pid_target Process procid_target 2512 4512 WerFault.exe 78 4548 4512 WerFault.exe 78 3664 4512 WerFault.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\da52f36dff2d572303b1e730b4a5702f050ca2a122c2f33e33d75b4c78dd09d7.exe"C:\Users\Admin\AppData\Local\Temp\da52f36dff2d572303b1e730b4a5702f050ca2a122c2f33e33d75b4c78dd09d7.exe"1⤵PID:4512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 4962⤵
- Program crash
PID:2512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 5042⤵
- Program crash
PID:4548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 5362⤵
- Program crash
PID:3664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4512 -ip 45121⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4512 -ip 45121⤵PID:1540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4512 -ip 45121⤵PID:4268