Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 10:34
Static task
static1
Behavioral task
behavioral1
Sample
ab59ab43bca69e4d8da366c81fc85b94ac14d12996d2743e0e1dba11dcc3eec8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ab59ab43bca69e4d8da366c81fc85b94ac14d12996d2743e0e1dba11dcc3eec8.exe
Resource
win10v2004-20220901-en
General
-
Target
ab59ab43bca69e4d8da366c81fc85b94ac14d12996d2743e0e1dba11dcc3eec8.exe
-
Size
769KB
-
MD5
74252893ab3fd0a0026122e6037d444e
-
SHA1
602c46a56191405114067d7b13e2f086d564b912
-
SHA256
ab59ab43bca69e4d8da366c81fc85b94ac14d12996d2743e0e1dba11dcc3eec8
-
SHA512
eed74fbda287d78e5a9d17a9f6d0f8a091eb86c328a4f0735d0fd53a150c8cf94fb9792b89b9edd7224aaf686d8d2ca06e35867289dce2291d65ca2a948115c5
-
SSDEEP
24576:Qa7VX9dsfan3JgPv0PvY+1L285yYZvfoANZ0wv3:X7VX92g3JLT1L285yYBzU
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5016-132-0x0000000000400000-0x0000000000618000-memory.dmp upx behavioral2/memory/5016-134-0x0000000000400000-0x0000000000618000-memory.dmp upx behavioral2/memory/5016-135-0x0000000000400000-0x0000000000618000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4372 5016 WerFault.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab59ab43bca69e4d8da366c81fc85b94ac14d12996d2743e0e1dba11dcc3eec8.exe"C:\Users\Admin\AppData\Local\Temp\ab59ab43bca69e4d8da366c81fc85b94ac14d12996d2743e0e1dba11dcc3eec8.exe"1⤵PID:5016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 5202⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5016 -ip 50161⤵PID:3320