Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2023, 12:55

General

  • Target

    47d27bb5f4a208f3081471d00e87d1e4.exe

  • Size

    3.5MB

  • MD5

    47d27bb5f4a208f3081471d00e87d1e4

  • SHA1

    472bb042dc730fddad7d4dd3b48d4369de463845

  • SHA256

    618d5757cf057b15ac4608340b2c7f641bf56661da501b5084b0fa9212a1dcfd

  • SHA512

    fe5acc6c508b77beb34d076b1f58ce17d77101454fdbf6cab573e3cffda683307fdb96979b6d09ad8c4fb09bf89cebb0a2bfabfb0c6f59193a228276be2c5cb5

  • SSDEEP

    24576:wtpH9qTz57hM4/btkcXoTYMl6cexqJJnDIT69NyvONbeKtppAFZg+v:qM57hr7+MxqJJnsT69dbeKtp4

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe
    "C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:4384
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2⤵
          PID:4388
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          2⤵
            PID:416
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 288
            2⤵
            • Program crash
            PID:4252
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2812 -ip 2812
          1⤵
            PID:3124

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/416-134-0x0000000000400000-0x000000000056C000-memory.dmp

            Filesize

            1.4MB

          • memory/416-153-0x0000000000400000-0x000000000056C000-memory.dmp

            Filesize

            1.4MB

          • memory/416-154-0x0000000000400000-0x000000000056C000-memory.dmp

            Filesize

            1.4MB

          • memory/416-157-0x0000000000400000-0x000000000056C000-memory.dmp

            Filesize

            1.4MB

          • memory/416-155-0x0000000000400000-0x000000000056C000-memory.dmp

            Filesize

            1.4MB

          • memory/2812-133-0x0000000000B00000-0x0000000000EB8000-memory.dmp

            Filesize

            3.7MB

          • memory/2812-266-0x0000000000B00000-0x0000000000EB8000-memory.dmp

            Filesize

            3.7MB