Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe
Resource
win7-20220901-en
2 signatures
150 seconds
General
-
Target
c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe
-
Size
189KB
-
MD5
6976277e1600cd91603714dbdfa92591
-
SHA1
732576046b049fd4a7093366894d3efd7fd33ab1
-
SHA256
c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a
-
SHA512
353717a09765e4dc49d4bb1d5c30b1d9b1df953a81dd009c047dce3085bd143ae6dbdf1309c801ab86f74e196f2fc9c1d88c7cb0381259d6218ebc86c34e8b54
-
SSDEEP
3072:FVm5jdZp1JeR07lfaytvSGRuo0vsxAJec6oMclbv7JLtRjAFxqlZUJtbMoIBZtko:FojdZp1JeR07lf7tvSfofI9RblAu3ct6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2044 1160 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1160 wrote to memory of 2044 1160 c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe 27 PID 1160 wrote to memory of 2044 1160 c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe 27 PID 1160 wrote to memory of 2044 1160 c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe 27 PID 1160 wrote to memory of 2044 1160 c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe 27 PID 1160 wrote to memory of 2044 1160 c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe 27 PID 1160 wrote to memory of 2044 1160 c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe 27 PID 1160 wrote to memory of 2044 1160 c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe"C:\Users\Admin\AppData\Local\Temp\c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 3322⤵
- Program crash
PID:2044
-