Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/SisFarmacia.exe

  • Size

    26.3MB

  • MD5

    d70ef7837cfe5384462b2beefa416a29

  • SHA1

    cd3a9add1593afdd2ed010d03293837275a0685f

  • SHA256

    db5f11d627bc35e0ae02c83b3aa8bcde104f8b0002213aa4b2ebdfc22dc80b23

  • SHA512

    9027c8dd06805b79f1e2dbf0ba83d87c3c01a642c4a92b2bf7f218814ac95b424a19855a20e146af8d2c2280f105edfd1235b27642e4ecdf20048c046a6a6a84

  • SSDEEP

    786432:+RVsd+VFvQYHQY1pjPPNsNlEDJ0Z8+hcO2ona7c:YVFY+1pbNi+N2CSaQ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe
    "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Users\Admin\AppData\Local\Temp\is-KUF83.tmp\SisFarmacia.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KUF83.tmp\SisFarmacia.tmp" /SL5="$801C4,26858922,797184,C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe"
      2⤵
      • Executes dropped EXE
      PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-KUF83.tmp\SisFarmacia.tmp

    Filesize

    2.5MB

    MD5

    27468e29378f0528abb039cd242b99a9

    SHA1

    b8c088508ff39708c1048b6fc64106339a8c5c52

    SHA256

    14e7028ed14eed990ef349ddcd991fe53c37416307b05e6cdc0c2eebeb8f6734

    SHA512

    1cc62d4c28cacc120c0bfd7ebc80432f6b17f2b0d4d9d51ebb2122e265138f42cd14ddc2992bb9c863cc2207f0c02abb7e2900aee5a4f08b971801078c3fb827

  • memory/748-132-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/748-134-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/748-137-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB