Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2023, 12:55

General

  • Target

    47d27bb5f4a208f3081471d00e87d1e4.exe

  • Size

    3.5MB

  • MD5

    47d27bb5f4a208f3081471d00e87d1e4

  • SHA1

    472bb042dc730fddad7d4dd3b48d4369de463845

  • SHA256

    618d5757cf057b15ac4608340b2c7f641bf56661da501b5084b0fa9212a1dcfd

  • SHA512

    fe5acc6c508b77beb34d076b1f58ce17d77101454fdbf6cab573e3cffda683307fdb96979b6d09ad8c4fb09bf89cebb0a2bfabfb0c6f59193a228276be2c5cb5

  • SSDEEP

    24576:wtpH9qTz57hM4/btkcXoTYMl6cexqJJnDIT69NyvONbeKtppAFZg+v:qM57hr7+MxqJJnsT69dbeKtp4

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe
    "C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:1112
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 104
        2⤵
        • Program crash
        PID:1212

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1112-54-0x0000000000400000-0x000000000056C000-memory.dmp

      Filesize

      1.4MB

    • memory/1112-55-0x0000000000400000-0x000000000056C000-memory.dmp

      Filesize

      1.4MB

    • memory/1112-72-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/1112-75-0x0000000000400000-0x000000000056C000-memory.dmp

      Filesize

      1.4MB

    • memory/1112-77-0x0000000000400000-0x000000000056C000-memory.dmp

      Filesize

      1.4MB

    • memory/1112-79-0x0000000000400000-0x000000000056C000-memory.dmp

      Filesize

      1.4MB

    • memory/2032-89-0x0000000000DA0000-0x0000000001158000-memory.dmp

      Filesize

      3.7MB