Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe
Resource
win10v2004-20220812-en
General
-
Target
e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe
-
Size
83KB
-
MD5
29a951be1978e2822e31e879ce25aec9
-
SHA1
c2407d3fc74f4f70dac3984a1e0c9f2756ffe101
-
SHA256
e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7
-
SHA512
0fd06a659fd834930891b2f6a41dfd525b73853ae78203f8e53de49d7e1dfc6f1f0d0dfb5188fb8691726b6128cfeeb66be03899a070486173eec65cadbbbbe7
-
SSDEEP
1536:sXTTTTz1itbxrIr7EmBC+fNvLM5cp8OWUUm7S4NAXCiVneb9RgSs4hUiLjpjVrsK:ZuMSplWDANKCaW9eD4SiLjHs2q
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1552 952 WerFault.exe 12 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 952 wrote to memory of 1552 952 e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe 27 PID 952 wrote to memory of 1552 952 e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe 27 PID 952 wrote to memory of 1552 952 e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe 27 PID 952 wrote to memory of 1552 952 e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe"C:\Users\Admin\AppData\Local\Temp\e8116096323f7375746b7bc2c0f7cc658bbd2b38a9b47ed080de4829698b40f7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 362⤵
- Program crash
PID:1552
-