Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/07/2024, 07:04

240701-hv4nmasckk 3

01/07/2024, 06:54

240701-hpnp8aydne 6

01/07/2024, 06:50

240701-hmedrsydjc 6

Analysis

  • max time kernel
    121s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 06:50

General

  • Target

    Release/CeleryApp.exe

  • Size

    8.8MB

  • MD5

    d2a7e4f3b8fdc023e6579c35e5e83769

  • SHA1

    43ce10ac8a1c9423cd70991bbb92c7ad9632cb2c

  • SHA256

    43f78f751afc09617b735d086c6855471e34d6ca78a6a862b6448bf67a8f0faf

  • SHA512

    d999132c597ff4c407b5de2c4aa9a39f95e92064680b370fb9e6966e1af0726fdd063d8e15e29fda370b163d71ead9da7d103fb36e37a2388432fb18ae47193a

  • SSDEEP

    98304:zQgLIRfyC7egWJ3iJzdjf4fwraOWcD9XdMPABIw/t6KHDicVwzUs7o:zQguhegD4fJOWs9XNBZ16M2cuU

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Release\CeleryApp.exe
    "C:\Users\Admin\AppData\Local\Temp\Release\CeleryApp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2432 -s 852
      2⤵
        PID:2316

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2432-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

      Filesize

      4KB

    • memory/2432-1-0x00000000012B0000-0x0000000001B76000-memory.dmp

      Filesize

      8.8MB

    • memory/2432-2-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2432-3-0x0000000000750000-0x0000000000790000-memory.dmp

      Filesize

      256KB

    • memory/2432-4-0x00000000011E0000-0x0000000001230000-memory.dmp

      Filesize

      320KB

    • memory/2432-5-0x000000001D2B0000-0x000000001DBCE000-memory.dmp

      Filesize

      9.1MB

    • memory/2432-7-0x00000000008B0000-0x00000000008BA000-memory.dmp

      Filesize

      40KB

    • memory/2432-6-0x00000000008B0000-0x00000000008BA000-memory.dmp

      Filesize

      40KB

    • memory/2432-8-0x00000000008B0000-0x00000000008BE000-memory.dmp

      Filesize

      56KB

    • memory/2432-9-0x0000000001230000-0x00000000012A4000-memory.dmp

      Filesize

      464KB

    • memory/2432-10-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

      Filesize

      4KB

    • memory/2432-11-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2432-12-0x00000000008B0000-0x00000000008BA000-memory.dmp

      Filesize

      40KB

    • memory/2432-13-0x00000000008B0000-0x00000000008BA000-memory.dmp

      Filesize

      40KB