Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
433s -
max time network
434s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/01/2025, 20:19 UTC
General
-
Target
Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/QtGui4.dll
-
Size
8.0MB
-
MD5
37957facc9afbdfbd119c8372c9cf0e3
-
SHA1
1f5584ae75e947ffcbe00dc17bc423bf3f906ad0
-
SHA256
bf52fec00b4f640d07bea3850096cc77983fca518bbec8122997b7ca561205f1
-
SHA512
24ef6418f904b646d31912e0f350a0eb10147015bbd4b3710aba62c5a1da5d001600d9a381beb8d871d30cc0b07cf2fdb034f81f60810d8c14899cacdf68ad4d
-
SSDEEP
98304:ixT4yTZMEMrIJCZxMvwQoVgN1617/PO1IQlS4Xsmw2zZQvkfsnXWP:ixbZxDJ9vv7617VQlSesn
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rdp Cracking tool @ virusbug1\KPortScan 3.0 @virusbug1\QtGui4.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rdp Cracking tool @ virusbug1\KPortScan 3.0 @virusbug1\QtGui4.dll",#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 7003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1896 -ip 18961⤵
Network
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse -
DNS22.89.16.2.in-addr.arpaRemote address:8.8.8.8:53Request22.89.16.2.in-addr.arpaIN PTRResponse22.89.16.2.in-addr.arpaIN PTRa2-16-89-22deploystaticakamaitechnologiescom
-
DNS7.98.51.23.in-addr.arpaRemote address:8.8.8.8:53Request7.98.51.23.in-addr.arpaIN PTRResponse7.98.51.23.in-addr.arpaIN PTRa23-51-98-7deploystaticakamaitechnologiescom
-
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS56.163.245.4.in-addr.arpaRemote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
DNS241.42.69.40.in-addr.arpaRemote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
DNS104.218.122.92.in-addr.arpaRemote address:8.8.8.8:53Request104.218.122.92.in-addr.arpaIN PTRResponse104.218.122.92.in-addr.arpaIN PTRa92-122-218-104deploystaticakamaitechnologiescom
-
DNS8.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request8.179.89.13.in-addr.arpaIN PTRResponse
-
DNS184.115.23.2.in-addr.arpaRemote address:8.8.8.8:53Request184.115.23.2.in-addr.arpaIN PTRResponse184.115.23.2.in-addr.arpaIN PTRa2-23-115-184deploystaticakamaitechnologiescom
No results found
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:5322.89.16.2.in-addr.arpadns
DNS Request
22.89.16.2.in-addr.arpa
-
8.8.8.8:537.98.51.23.in-addr.arpadns
DNS Request
7.98.51.23.in-addr.arpa
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:5356.163.245.4.in-addr.arpadns
DNS Request
56.163.245.4.in-addr.arpa
-
8.8.8.8:53241.42.69.40.in-addr.arpadns
DNS Request
241.42.69.40.in-addr.arpa
-
8.8.8.8:53104.218.122.92.in-addr.arpadns
DNS Request
104.218.122.92.in-addr.arpa
-
8.8.8.8:538.179.89.13.in-addr.arpadns
DNS Request
8.179.89.13.in-addr.arpa
-
8.8.8.8:53184.115.23.2.in-addr.arpadns
DNS Request
184.115.23.2.in-addr.arpa