Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
d795cb670fc422237a154003add9e3d13a2f416e9ba5f4dc955f0692562457e7.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
d795cb670fc422237a154003add9e3d13a2f416e9ba5f4dc955f0692562457e7.exe
Resource
win10v2004-20231020-en
General
-
Target
d795cb670fc422237a154003add9e3d13a2f416e9ba5f4dc955f0692562457e7.exe
-
Size
4.4MB
-
MD5
d9926e901312c8bff0b47a8b308215cf
-
SHA1
5da64d215d6031f275c97f458d977711bf3ad78b
-
SHA256
d795cb670fc422237a154003add9e3d13a2f416e9ba5f4dc955f0692562457e7
-
SHA512
28afbd15de38f55516c69dc6a0e65299da133ae1295827781fe7a556919d6144705bdacc7f8c99a05e073635c6b097b9dad6d090eee1c6452239884f8860bfcc
-
SSDEEP
98304:tQS1zFowCOhvM13UYOTnlpKYBpENKDWvr4S2Tcx0Ma0:+iHXa13UYGjK8M2z0
Malware Config
Signatures
-
Program crash 3 IoCs
pid pid_target Process procid_target 2108 3868 WerFault.exe 84 2788 3868 WerFault.exe 84 760 3868 WerFault.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\d795cb670fc422237a154003add9e3d13a2f416e9ba5f4dc955f0692562457e7.exe"C:\Users\Admin\AppData\Local\Temp\d795cb670fc422237a154003add9e3d13a2f416e9ba5f4dc955f0692562457e7.exe"1⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 9442⤵
- Program crash
PID:2108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 9802⤵
- Program crash
PID:2788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1402⤵
- Program crash
PID:760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3868 -ip 38681⤵PID:4544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3868 -ip 38681⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3868 -ip 38681⤵PID:4072