Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 21:51
Static task
static1
Behavioral task
behavioral1
Sample
90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe
Resource
win7-20220901-en
2 signatures
150 seconds
General
-
Target
90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe
-
Size
232KB
-
MD5
a25cd0f5a9d22dbb325545a1926b8490
-
SHA1
3ba078975b76f80569dd88326115ff6092c2cdd8
-
SHA256
90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b
-
SHA512
f58e73584a5e54b9ce17ae27a36c07a3244693567a9d4d75e85e80e30abb059b7aa0c4cc4c8c3b3f0cfbce9fcd674d4b0a4cdc427a6f2ad4e155e076892156b5
-
SSDEEP
3072:E4eViA4NiAWHF27+YoFnWnHAUDBNBzLJUnJqlmrHKCRjQnkIxVAl:xDA4sk+BWgQNBzLNlmrqClQf6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 988 1128 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1128 wrote to memory of 988 1128 90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe 27 PID 1128 wrote to memory of 988 1128 90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe 27 PID 1128 wrote to memory of 988 1128 90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe 27 PID 1128 wrote to memory of 988 1128 90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe 27 PID 1128 wrote to memory of 988 1128 90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe 27 PID 1128 wrote to memory of 988 1128 90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe 27 PID 1128 wrote to memory of 988 1128 90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe"C:\Users\Admin\AppData\Local\Temp\90e314dfc4eeec640b17ad2d09a1bd0da66d417fc276f5c4ba142ea211c1c14b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 2762⤵
- Program crash
PID:988
-