Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    333s
  • max time network
    396s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 14:08

General

  • Target

    be385638d0027f818e559e1e1512a9d143c8e7e358992de29298bb62c13b37e8.exe

  • Size

    36KB

  • MD5

    326ccbdce086af60a861a01dc68a873f

  • SHA1

    02b3b266d7a63a000fefe7ec9ce4d724e07b68a5

  • SHA256

    be385638d0027f818e559e1e1512a9d143c8e7e358992de29298bb62c13b37e8

  • SHA512

    9f59413380e2399333a5a4e934909b4ff331e9717384d4d2db5db8d85d23f2412057d520631a70f10f34b198d3bdeb415579335b46bb506c252191c1e8d31b9a

  • SSDEEP

    384:NbHZhLS3+WpMyVbNzkpVhEevs79zbsj0JLALiFt4piWini:tZhLS/Bkvh7AzbsskLiFepiWi

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be385638d0027f818e559e1e1512a9d143c8e7e358992de29298bb62c13b37e8.exe
    "C:\Users\Admin\AppData\Local\Temp\be385638d0027f818e559e1e1512a9d143c8e7e358992de29298bb62c13b37e8.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 520
      2⤵
      • Program crash
      PID:1848
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4876 -ip 4876
    1⤵
      PID:2396

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4876-132-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB