Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
472s -
max time network
447s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09/01/2024, 19:33
General
-
Target
INQ J312R.exe
-
Size
1.2MB
-
MD5
015dbff467968a31d207dfc65eab7a2a
-
SHA1
172f2a10a150a1d45885e60b93e55ac1ad9d1ca4
-
SHA256
ee49b4bfcca622cb2f82b2b61c5c3587fc18c1f9d663aa30cf579eaf409ba2ea
-
SHA512
e39dae1b7680148b4ed8073083f97c03a5fb05ce62bc5400f0fdce836b341b19726300e39f33b9ffd929ae4f0980708c4d8c00347dbf48a08e051f2c7d07fd57
-
SSDEEP
24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aezIWgzRGygKS2RufvA:mTvC/MTQYxsWR7ae0WIM92Uf
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQ J312R.exe"C:\Users\Admin\AppData\Local\Temp\INQ J312R.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQ J312R.exe"C:\Users\Admin\AppData\Local\Temp\INQ J312R.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 2123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1864 -ip 18641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD568cab616cb1d2800c6c70b70f76da7e2
SHA149e6eeb08d8b3b42d61520aea47a4b00d923a0f4
SHA256b9d301038978f3da423b7878277c5d76a47261a9edc9c2cdc449c0e0e684686d
SHA512ece30d3ddeb8e819ff319329424f1fb87e02d752c518edfd31faba27404e3c0bd523f0879ac0c2217470ef6d4539a2356f4c387e8d7a0c7acaf116ffedded5bd
-
Filesize
252KB
-
Filesize
3.3MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
16KB