Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2024, 15:29

General

  • Target

    2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe

  • Size

    6.6MB

  • MD5

    98db604fb4ada4fa212eee3cb179713b

  • SHA1

    ae9d47d445574350ac870d123e55230137e8c340

  • SHA256

    0bf6ae11030acfd8498a51843366b153f478d2ae9d3505f3cd54ce1d07cc1516

  • SHA512

    65c1d7d6776ebb4766d9a47a11f3bf3a89fefb6aac90bbf334d05b8172b812ea02d05f0d3d364affb8db8b134bd097bf819ff39acb2b9f8df68045f3edadab48

  • SSDEEP

    3072:eblUsHGa58CS9yDcrGKDlvf6CzOmEnNiQPyCbYmPUK+v+Q98XUl:ibl5UyDcriCqmEncUjMmPIvzqe

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4508
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 224
      2⤵
      • Program crash
      PID:3628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4508 -ip 4508
    1⤵
      PID:1744

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4508-0-0x0000000000870000-0x0000000000F05000-memory.dmp

      Filesize

      6.6MB