Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2852-114-0...ry.exe

windows7-x64

10

2852-114-0...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2024, 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2852-114-0x0000000000110000-0x0000000000CFD000-memory.exe

  • Size

    11.9MB

  • MD5

    0e5f38e6037ab560fd788693323e4a98

  • SHA1

    20fe5255acd0f31046329284d3c5d8b1fb4658cc

  • SHA256

    3173beb38cd140ed69264f47f107a4cf37077f3f0c13928cf5f93eb4eeb79cb6

  • SHA512

    dccc31187de777d6d426403bbb60ad2b1e05d8329311ec1d96ebba11218556647542ecb5109457e6bb042cb2e157ba9f79aa550c6333ef6466c5296b004d67e7

  • SSDEEP

    98304:OKcc3eTNxTMXRBSE9XXVcqnIR7I2qmG0AcCicoyJK4zjPVFldLac:NczQlljm0Pm/DyKijPnldLac

Score
10/10
stealcstealer

Malware Config

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2852-114-0x0000000000110000-0x0000000000CFD000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2852-114-0x0000000000110000-0x0000000000CFD000-memory.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 36
      2⤵
      • Program crash
      PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3012-0-0x0000000000110000-0x0000000000CFD000-memory.dmp

    Filesize

    11.9MB

    Download