Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe
Resource
win10v2004-20221111-en
General
-
Target
841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe
-
Size
22KB
-
MD5
8c40d71805514cde5b6c242360fcf4ab
-
SHA1
ec7fef46632218e26f38e70737b000975313e5b6
-
SHA256
841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b
-
SHA512
585da13bb50de1f43cad8c7ec8e2fb89ada86dca5b15e510be07f029fa81c7e3617a8421c20eb5bae8213a74a3745d847950ae0a20ef6711165be13cfb256d02
-
SSDEEP
384:DaSkXTCs0yPR1DVp8avaE+bsKqg+GnxIfGVyKeGYYMRmfgF3DrbH:Da1TCW1vvaE+bVqgABKeGY3DfH
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1880 1976 WerFault.exe 25 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1880 1976 841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe 26 PID 1976 wrote to memory of 1880 1976 841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe 26 PID 1976 wrote to memory of 1880 1976 841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe 26 PID 1976 wrote to memory of 1880 1976 841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe"C:\Users\Admin\AppData\Local\Temp\841127089b5f598a4cf45fbdf27e7c366fc4823b05abb02fa889b2df2bcdd70b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 482⤵
- Program crash
PID:1880
-