Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
18/10/2022, 02:31
Behavioral task
behavioral1
Sample
1500-56-0x0000000000A70000-0x0000000001398000-memory.exe
Resource
win7-20220901-en
4 signatures
150 seconds
General
-
Target
1500-56-0x0000000000A70000-0x0000000001398000-memory.exe
-
Size
9.2MB
-
MD5
6d929114a3284888f3f8c10261384391
-
SHA1
0f928f41f1a7fd8d3e71e1a15fe94e11bf4d9b68
-
SHA256
97884b8e18ad0f52de4d49417cdffeae030905cde46da43d88f5938349542def
-
SHA512
07d43745246fec2cb93b736d518c02202ac398b5a0ef021796b5790c3e616b2c819a8af4d2ee49b52cd5b5d15185c0f69cf5f8af10c3000f9ccf0ab9ae7a27e0
-
SSDEEP
98304:XRYgVvxczu4hvG4TgsCLMjG7ZSj8UruU2fHyQEY0JIi4VaLGGteqp8OH7FCUG:jKtPFru/HKGi4VqGG9XFX
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1340-55-0x00000000004D0000-0x0000000000DF8000-memory.dmp themida -
Program crash 1 IoCs
pid pid_target Process procid_target 1228 1340 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1340 wrote to memory of 1228 1340 1500-56-0x0000000000A70000-0x0000000001398000-memory.exe 27 PID 1340 wrote to memory of 1228 1340 1500-56-0x0000000000A70000-0x0000000001398000-memory.exe 27 PID 1340 wrote to memory of 1228 1340 1500-56-0x0000000000A70000-0x0000000001398000-memory.exe 27 PID 1340 wrote to memory of 1228 1340 1500-56-0x0000000000A70000-0x0000000001398000-memory.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\1500-56-0x0000000000A70000-0x0000000001398000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1500-56-0x0000000000A70000-0x0000000001398000-memory.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 362⤵
- Program crash
PID:1228
-