Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

9

csrss.exe

windows7-x64

8

csrss.exe

windows10-2004-x64

8

ntldll.dll

windows7-x64

8

ntldll.dll

windows10-2004-x64

8

Analysis

  • max time kernel
    88s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 13:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    csrss.exe

  • Size

    392KB

  • MD5

    64f0afeb5835d985a34b5a69f3673d49

  • SHA1

    5c4ded38e009ee1cc442aedc093affb394cea806

  • SHA256

    6fc132918b9ba4fc55d19ca4dad12f20745eea4b9fc85cf5e1abfdc65e1db4fe

  • SHA512

    e5f2229e94f1696de9e7f2b08e01487eefecc2ae426417cfe289457532acf4ce1e9ee6082c7d886e4aa6a6fb37370791ea815dcd43e11a44afc0412265197e70

  • SSDEEP

    6144:8gAK4iyFJa5Bk/LtzAJg3pKOEfsMYE3XRU/3EoD2gUhZ5BlZrMol:GKByFJa/k/ZZ3pZE193XCSgUPjc+

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\csrss.exe
    "C:\Users\Admin\AppData\Local\Temp\csrss.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: GetForegroundWindowSpam
    PID:668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/668-54-0x0000000000730000-0x00000000020E4000-memory.dmp

    Filesize

    25.7MB

    Download

  • memory/668-55-0x0000000000730000-0x00000000020E4000-memory.dmp

    Filesize

    25.7MB

    Download