Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 12:38
Behavioral task
behavioral1
Sample
a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe
Resource
win10v2004-20220812-en
General
-
Target
a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe
-
Size
48KB
-
MD5
5ce6a67d4b59189d701ae656d5cf1fbe
-
SHA1
ba4d1332c504b577b9d56e64f924f02ae9859caf
-
SHA256
a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd
-
SHA512
95e146d32e37d45ee09e9cf6c03a34a6697ee560f36eb7d45a29beeec0aa815f2eb39760c6ce2eb642a3309566100336580bc43f7643dc6cb54cba037dac2066
-
SSDEEP
768:UE/OA8FyKRuwjRGhedlrp0nnzlvaJXbgmj5MjSLCP0+pZkAyx6deV9x:DOSEjRFllz2mmj0CcI+q0x
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1824 1364 WerFault.exe 23 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1364 wrote to memory of 1824 1364 a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe 28 PID 1364 wrote to memory of 1824 1364 a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe 28 PID 1364 wrote to memory of 1824 1364 a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe 28 PID 1364 wrote to memory of 1824 1364 a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe"C:\Users\Admin\AppData\Local\Temp\a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1202⤵
- Program crash
PID:1824
-