Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
b54385cac7c7603add2cb77231e41c1b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b54385cac7c7603add2cb77231e41c1b.exe
Resource
win10v2004-20240226-en
General
-
Target
b54385cac7c7603add2cb77231e41c1b.exe
-
Size
881KB
-
MD5
b54385cac7c7603add2cb77231e41c1b
-
SHA1
db31ba72546dbe482780a7bfb7ef78a0b71be588
-
SHA256
52ad041c41c1b4669ed463c47cf66e6a3e63ed90130838b4661940d1e82774e3
-
SHA512
339eb019fde04bb24363a9a222fecb27de57fb82906fb01773a0c8e36ec219e2243541229b314f287c89242ed9e2e0d0b1ac78014bbaf6fd93919e34d21881fe
-
SSDEEP
12288:1QFPuq4zGk02X49/H05yyTpNjrQlAwVlAwL3m5YVdh1Dshk1+bDdy7:cuq8X4FH0MyTpNjMlhlQu3yZy7
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2768 2692 WerFault.exe 27 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2692 b54385cac7c7603add2cb77231e41c1b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2768 2692 b54385cac7c7603add2cb77231e41c1b.exe 28 PID 2692 wrote to memory of 2768 2692 b54385cac7c7603add2cb77231e41c1b.exe 28 PID 2692 wrote to memory of 2768 2692 b54385cac7c7603add2cb77231e41c1b.exe 28 PID 2692 wrote to memory of 2768 2692 b54385cac7c7603add2cb77231e41c1b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b54385cac7c7603add2cb77231e41c1b.exe"C:\Users\Admin\AppData\Local\Temp\b54385cac7c7603add2cb77231e41c1b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 2082⤵
- Loads dropped DLL
- Program crash
PID:2768
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
888KB
MD55efd8d8a58ee7e9c02f8ec8582198f12
SHA19902c76b49e273e9374de13ae77ff10b81b084f8
SHA2561774c5fc6525587a600abf719d2c64db7218d461c5c8d964ea3d531841f96859
SHA512415fe17a316bda603cec5f0a9ccaaa7de3d22b8a13cd04aceb24b5a38172f64a672f24c1c3c43e57cd4148bd12d01c0c0c30c3781970f41c7d34acccca2e52af