Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 05:05
Static task
static1
Behavioral task
behavioral1
Sample
91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe
Resource
win10v2004-20220812-en
General
-
Target
91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe
-
Size
268KB
-
MD5
6cad156f8b7d3e34f449db7803c496c0
-
SHA1
473bf6b793cfbefbbdba31d3309b87f0f0c8bd96
-
SHA256
91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78
-
SHA512
e211d225f10d24a7d0a6cda61c72d0cac236cdd11ea45410eecae53a4d18559a3d234019ea5154bc19ae4b5dbc379256ac9c3422bb991b72fb681030b2dd8d05
-
SSDEEP
6144:0sRbC6qFULFIk3ZRY5wALXqo1jmUZxL6xQGQW8w:e6qKLemu3LXqs76l5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1892 980 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 980 wrote to memory of 1892 980 91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe 28 PID 980 wrote to memory of 1892 980 91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe 28 PID 980 wrote to memory of 1892 980 91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe 28 PID 980 wrote to memory of 1892 980 91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe"C:\Users\Admin\AppData\Local\Temp\91fcc7f102ceecbe5bd72dc66d77cc01004583aceb7d1105b20f663750e36e78.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 922⤵
- Program crash
PID:1892
-