Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

b6c97f20f3...32.exe

windows7-x64

3

b6c97f20f3...32.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    137s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 19:43 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b6c97f20f3b31d2e919e49bb2bfc3a50_exe32.exe

  • Size

    276KB

  • MD5

    b6c97f20f3b31d2e919e49bb2bfc3a50

  • SHA1

    05571f61e354635b3389bbb33e911b5aeeaa5201

  • SHA256

    173239fecbc1bca0fba40ea5cc30df6e61bfa6ecfb37e6b6ac9767334cbba60b

  • SHA512

    a482875f65ec99590d4c4bc61f7d43f3d360456c34f0ff77653e9a53049196469f18e41971646089d1c600f0b17e8d0f947773c6b07dddaca13086a0ac6b6f00

  • SSDEEP

    3072:q8RinudiP52xx67lLdhbiH4WL5GURlSjgjxxt8jyuRyf:HkgiPA6RrfWL5LRlUivKry

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6c97f20f3b31d2e919e49bb2bfc3a50_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\b6c97f20f3b31d2e919e49bb2bfc3a50_exe32.exe"
    1⤵
      PID:5048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 220
        2⤵
        • Program crash
        PID:908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 224
        2⤵
        • Program crash
        PID:4868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5048 -ip 5048
      1⤵
        PID:1304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5048 -ip 5048
        1⤵
          PID:2412

        Network

        • flag-us
          DNS
          8.8.8.8.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          8.8.8.8.in-addr.arpa
          IN PTR
          Response
          8.8.8.8.in-addr.arpa
          IN PTR
          dnsgoogle
        • flag-us
          DNS
          208.194.73.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          208.194.73.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          163.252.72.23.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          163.252.72.23.in-addr.arpa
          IN PTR
          Response
          163.252.72.23.in-addr.arpa
          IN PTR
          a23-72-252-163deploystaticakamaitechnologiescom
        • flag-us
          DNS
          20.160.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          20.160.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          59.128.231.4.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          59.128.231.4.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          146.78.124.51.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          146.78.124.51.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          157.123.68.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          157.123.68.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          171.39.242.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          171.39.242.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          240.81.21.72.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          240.81.21.72.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          48.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          48.229.111.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          121.208.253.8.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          121.208.253.8.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          66.112.168.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          66.112.168.52.in-addr.arpa
          IN PTR
          Response
        No results found
        • 8.8.8.8:53
          8.8.8.8.in-addr.arpa
          dns
          66 B
           90 B
           1
          1

          DNS Request

          8.8.8.8.in-addr.arpa

        • 8.8.8.8:53
          208.194.73.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          208.194.73.20.in-addr.arpa

        • 8.8.8.8:53
          163.252.72.23.in-addr.arpa
          dns
          72 B
           137 B
           1
          1

          DNS Request

          163.252.72.23.in-addr.arpa

        • 8.8.8.8:53
          20.160.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          20.160.190.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          59.128.231.4.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          59.128.231.4.in-addr.arpa

        • 8.8.8.8:53
          146.78.124.51.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          146.78.124.51.in-addr.arpa

        • 8.8.8.8:53
          157.123.68.40.in-addr.arpa
          dns
          72 B
           146 B
           1
          1

          DNS Request

          157.123.68.40.in-addr.arpa

        • 8.8.8.8:53
          171.39.242.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          171.39.242.20.in-addr.arpa

        • 8.8.8.8:53
          240.81.21.72.in-addr.arpa
          dns
          71 B
           142 B
           1
          1

          DNS Request

          240.81.21.72.in-addr.arpa

        • 8.8.8.8:53
          48.229.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          48.229.111.52.in-addr.arpa

        • 8.8.8.8:53
          121.208.253.8.in-addr.arpa
          dns
          72 B
           126 B
           1
          1

          DNS Request

          121.208.253.8.in-addr.arpa

        • 8.8.8.8:53
          66.112.168.52.in-addr.arpa
          dns
          72 B
           146 B
           1
          1

          DNS Request

          66.112.168.52.in-addr.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5048-0-0x0000000000400000-0x0000000000445000-memory.dmp

          Filesize

          276KB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.