Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RunMePlsgpj.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
RunMePlsgpj.exe
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
RunMePlsgpj.exe
-
Size
13.6MB
-
MD5
bc5b47d8c43fa4fcb52876e92e796b42
-
SHA1
4ef1cbe3b6834af2080b06d379f43df7d898421d
-
SHA256
b06484457fac9078aff0b7daef89cbc30d155023313d172045775e28b67e7ebd
-
SHA512
00e89b63b0264235eb9f04dcee2cf75222fced4bcf6564aa4cbee9ff78e4bdc16497ad3b00cd16e7cbc2d442513e187aae6e286bbaef27554ea8c2f5d79d318d
-
SSDEEP
393216:orgbHdc3QjfclgA/BOWkDRrCYV4BHtW/BZo1:orgRcgrwOWXY8AZo
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 220 3992 WerFault.exe 89 -
Suspicious behavior: RenamesItself 5 IoCs
pid Process 3528 RunMePlsgpj.exe 3528 RunMePlsgpj.exe 3528 RunMePlsgpj.exe 3992 RunMePls.gpj.exe 3992 RunMePls.gpj.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3528 wrote to memory of 3992 3528 RunMePlsgpj.exe 89 PID 3528 wrote to memory of 3992 3528 RunMePlsgpj.exe 89 PID 3528 wrote to memory of 3992 3528 RunMePlsgpj.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\RunMePlsgpj.exe"C:\Users\Admin\AppData\Local\Temp\RunMePlsgpj.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\RunMePls.gpj.exeC:\Users\Admin\AppData\Local\Temp\RunMePls.gpj.exe2⤵
- Suspicious behavior: RenamesItself
PID:3992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 7403⤵
- Program crash
PID:220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3992 -ip 39921⤵PID:3716