Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2023, 16:46

General

  • Target

    ac19f8cb0006f1eef750f7dc3d2e43762b12d2c99a7af1671fa53d4c9bf54bb1.exe

  • Size

    483KB

  • MD5

    2979e0b02971217f9799023f0b4f1142

  • SHA1

    8d2ec04fc9586da62274a029efbd2abfde719186

  • SHA256

    ac19f8cb0006f1eef750f7dc3d2e43762b12d2c99a7af1671fa53d4c9bf54bb1

  • SHA512

    e86d6c87ba6442e10e20170cab584811043e1716fbc6f84e4817c154356a5a6cfe12780d9c8f58b604e40eebc3aae8f04867bfa2401d08fe435d7ee1c421ea16

  • SSDEEP

    6144:ND0m39/ilKbZe/LN9dREb86j0BBim2QMeGzWl174svQWCiXlBQ65/pa:ZX9/8uQ/LvEb5j0C3QM8l1kmQWB1Bhl

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac19f8cb0006f1eef750f7dc3d2e43762b12d2c99a7af1671fa53d4c9bf54bb1.exe
    "C:\Users\Admin\AppData\Local\Temp\ac19f8cb0006f1eef750f7dc3d2e43762b12d2c99a7af1671fa53d4c9bf54bb1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4360
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 476
      2⤵
      • Program crash
      PID:880
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4360 -ip 4360
    1⤵
      PID:2396

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4360-134-0x0000000004A60000-0x0000000004AD0000-memory.dmp

      Filesize

      448KB

    • memory/4360-135-0x0000000000400000-0x0000000002D20000-memory.dmp

      Filesize

      41.1MB

    • memory/4360-140-0x0000000004AE0000-0x0000000004AE7000-memory.dmp

      Filesize

      28KB

    • memory/4360-141-0x0000000004C20000-0x0000000005020000-memory.dmp

      Filesize

      4.0MB

    • memory/4360-142-0x0000000004C20000-0x0000000005020000-memory.dmp

      Filesize

      4.0MB

    • memory/4360-144-0x0000000000400000-0x0000000002D20000-memory.dmp

      Filesize

      41.1MB