Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
133s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
23/09/2023, 06:52
Static task
static1
General
-
Target
dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe
-
Size
365KB
-
MD5
86261ced779abc6305c3858b3531c12c
-
SHA1
23a8b8ef06c5898485ad6deb3da369f2599ba7f0
-
SHA256
dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da
-
SHA512
2cc5c9c6307394c6f7a339c33cbf6f3e205a1d2d7309cfb38cdc54278f96e513579508819e01ecff5f2db445d1cd83e273b35e322c1e0b39e8cd79ee3d7e4dee
-
SSDEEP
6144:395frpxdonyq4zaG2u5AOceKWorX0PE6pdGkpnosQWquqp:3Drp0/9u5SenpnPRquqp
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4956 set thread context of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 -
Program crash 1 IoCs
pid pid_target Process procid_target 3440 4956 WerFault.exe 69 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70 PID 4956 wrote to memory of 4252 4956 dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe"C:\Users\Admin\AppData\Local\Temp\dd46f59718b656c0057bb3899637ab5f79e6bf29f32645fa71d8251dd5be66da.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:4252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 2442⤵
- Program crash
PID:3440
-