Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2023, 05:36

General

  • Target

    2023-05-23_6c1b52b32e43fc787c4ce5999623f902_gandcrab.exe

  • Size

    155KB

  • MD5

    6c1b52b32e43fc787c4ce5999623f902

  • SHA1

    9f4bbeea5d82214b947636f3bc10930b696f03f9

  • SHA256

    e008619c8f508111f54af12c825b77ac01240462dde04c911aeb06759898dbbc

  • SHA512

    75d5f7f372f2522e47b913b457ac66c11d6c86236d0640c209c9690f4ebb25ee4a6c66dc13065e836d090624a676176b61096ff698629a1484867e9e968c7fea

  • SSDEEP

    3072:l5K/B0toLQSNJElZHQsozTS+SMqqDL2/TrKvIG:lcytwtQ1yTS+xqqDL6HKF

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-05-23_6c1b52b32e43fc787c4ce5999623f902_gandcrab.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-05-23_6c1b52b32e43fc787c4ce5999623f902_gandcrab.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 88
      2⤵
      • Program crash
      PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads