Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21/06/2022, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
Kzckpxc.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Kzckpxc.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
Kzckpxc.exe
-
Size
35KB
-
MD5
46c7424bbc974b8071f30e2c6494612b
-
SHA1
7e957166a5a73c6e7ddf9af391fd1837f4339a99
-
SHA256
81bc33ce9bf2c1eaec168f5a5a4c2da715a2fcbc8972daa23834e22e3d27c547
-
SHA512
b8463d95dd900c9a543cf7d9f9c34d6d557b84688c84c3b68f026ffd3ba5fe909b785a7de69d6c75ade8327e059840d7fdaa27634df357e8aad591fbc7a40544
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1216 1880 WerFault.exe 26 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1880 Kzckpxc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1880 wrote to memory of 1216 1880 Kzckpxc.exe 27 PID 1880 wrote to memory of 1216 1880 Kzckpxc.exe 27 PID 1880 wrote to memory of 1216 1880 Kzckpxc.exe 27 PID 1880 wrote to memory of 1216 1880 Kzckpxc.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kzckpxc.exe"C:\Users\Admin\AppData\Local\Temp\Kzckpxc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 10482⤵
- Program crash
PID:1216
-