Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    79s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 12:20

General

  • Target

    fd40953fefc8eec1bf16b2dee8c917e41c782e09d8f4a0c9c4974daea58d3faf.exe

  • Size

    617KB

  • MD5

    b4590f9fa30ebe25dc7dbbdc489adc35

  • SHA1

    38ca7c90c4ffd08ff71d174540be575318bbce21

  • SHA256

    fd40953fefc8eec1bf16b2dee8c917e41c782e09d8f4a0c9c4974daea58d3faf

  • SHA512

    cdb4a1c41d400b170b372ff68291b91620f04c38c6f499835680593310d30eaf343cbd72dcae6d0a68653e2420781a5f1ca52b26798f7f42f5e45c237b738782

  • SSDEEP

    12288:Ue4EWDvuFlWMQ0/KutoOuM020Qp8znWrg:Ubu2MQ0ZBuI8znWrg

Score
3/10

Malware Config

Signatures

  • Program crash 3 IoCs
  • Suspicious use of UnmapMainImage 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd40953fefc8eec1bf16b2dee8c917e41c782e09d8f4a0c9c4974daea58d3faf.exe
    "C:\Users\Admin\AppData\Local\Temp\fd40953fefc8eec1bf16b2dee8c917e41c782e09d8f4a0c9c4974daea58d3faf.exe"
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 552
      2⤵
      • Program crash
      PID:3576
    • C:\Users\Admin\AppData\Local\Temp\fd40953fefc8eec1bf16b2dee8c917e41c782e09d8f4a0c9c4974daea58d3faf.exe
      start
      2⤵
      • Suspicious use of UnmapMainImage
      PID:2376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 504
        3⤵
        • Program crash
        PID:4184
    • C:\Users\Admin\AppData\Local\Temp\fd40953fefc8eec1bf16b2dee8c917e41c782e09d8f4a0c9c4974daea58d3faf.exe
      watch
      2⤵
      • Suspicious use of UnmapMainImage
      PID:2240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 508
        3⤵
        • Program crash
        PID:4384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1656 -ip 1656
    1⤵
      PID:4332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2376 -ip 2376
      1⤵
        PID:3672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2240 -ip 2240
        1⤵
          PID:4528

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1656-132-0x000000007FE30000-0x000000007FE4F000-memory.dmp

          Filesize

          124KB

        • memory/1656-133-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/1656-136-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/2240-138-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/2240-140-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/2376-137-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/2376-139-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB