Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2023, 16:03

General

  • Target

    NodeBeamEditor/bin/Qt5Core.dll

  • Size

    4.6MB

  • MD5

    87d6460772f138429cb8cc241b9db217

  • SHA1

    724b9536224150a3f2c4ea512241602c8b6b34f1

  • SHA256

    a7e2b3051de8e30993ed0f0fc6d6ef75c2d2e64c68bf499dc5bca2f008195ef8

  • SHA512

    e006ec0c8ed3a7ff56f6bb8f682c9ad80c20dcc46fb5c9cb111abb0c728ec7e71f553a9a8c8aa84f6ad038e00e33e345dec7261761a2daa6d0852edc0159e258

  • SSDEEP

    98304:2Y9qoTEpnpZrYfDzSQorYbs3AtLu9ZYF7Cn3L3K7F96CoqmNSJsv6tWKFdu9C1c:NIpnvsfyQolkuvYle36oqmNSJsv6tWK0

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\Qt5Core.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\Qt5Core.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 264
        3⤵
        • Program crash
        PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1640-55-0x000000006E940000-0x000000006E964000-memory.dmp

    Filesize

    144KB

  • memory/1640-56-0x0000000064940000-0x0000000064954000-memory.dmp

    Filesize

    80KB

  • memory/1640-54-0x0000000068880000-0x0000000068D26000-memory.dmp

    Filesize

    4.6MB

  • memory/1640-57-0x000000006FC40000-0x000000006FD41000-memory.dmp

    Filesize

    1.0MB

  • memory/1640-58-0x0000000061A40000-0x0000000061CED000-memory.dmp

    Filesize

    2.7MB

  • memory/1640-59-0x0000000068F80000-0x0000000069133000-memory.dmp

    Filesize

    1.7MB

  • memory/1640-60-0x0000000066500000-0x0000000067999000-memory.dmp

    Filesize

    20.6MB