Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe
Resource
win7-20221111-en
2 signatures
150 seconds
General
-
Target
7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe
-
Size
167KB
-
MD5
209049e3af867ad86523cd1d47d3c458
-
SHA1
d8b67f80ffb58d1d5f40e9852cab0c06b334a819
-
SHA256
7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04
-
SHA512
2d51fea16ec4735ef62dc8c446f5bb9f7052f8574cf194d34cb51b1e50abdc8668860382d68dc3eff7e503b534ad1a539e47414d47fcf2d9287a9b75078cb809
-
SSDEEP
3072:vNQKPWDyRI0fFJltZrpReFX3alAn1ETparGkSlgx6JoywWIdU3FN:vNSDyRIkFthp7mWEGkSlgxBWIw
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 808 948 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 948 wrote to memory of 808 948 7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe 28 PID 948 wrote to memory of 808 948 7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe 28 PID 948 wrote to memory of 808 948 7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe 28 PID 948 wrote to memory of 808 948 7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe"C:\Users\Admin\AppData\Local\Temp\7683bdddee5dbacdcfe45fee1df7d513d23aa7721b080835f70752fffa597e04.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 1602⤵
- Program crash
PID:808
-