Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 22:19

General

  • Target

    812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe

  • Size

    82KB

  • MD5

    41e3d7fac5c87f54e742ceb0d658556f

  • SHA1

    0b83b3a80db525bc0c9d5188064ad354a9ee91cd

  • SHA256

    812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758

  • SHA512

    de3af1d05f57f74141b78db8712eb13050c055568f078b07e07d15a76a971708cd6273f8d64f49c44be52f33028963b04f48fe1a77467daa2e5033e39b9b6446

  • SSDEEP

    1536:Y+xjS3Jjzt+hRnPzaNfQd7qjoq2DRJcqVIBH+nYoXzGaGlPjEmbK3LyQCh1DEhpV:Y+J8JYbPzaNACj2D+78GzJb8LyFzIz

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe
    "C:\Users\Admin\AppData\Local\Temp\812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 284
      2⤵
      • Program crash
      PID:852
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 284
      2⤵
      • Program crash
      PID:1256
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1964 -ip 1964
    1⤵
      PID:2952

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1964-132-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/1964-133-0x0000000000580000-0x0000000000584000-memory.dmp

      Filesize

      16KB