Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
35s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe
Resource
win10v2004-20221111-en
General
-
Target
b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe
-
Size
20KB
-
MD5
aaf4a1c743959eba6506642734fc1c29
-
SHA1
b2e1b645a7cc572da753d7983af586b0b9bf6889
-
SHA256
b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874
-
SHA512
403646b1b73a3ae847141e3edfe78bb3e43ffee2ebcb823858962daadc5d5a06310da6ca2383d9afd3eb52915db0a7608ea9e5f86b9606c79945c03fbc470fb8
-
SSDEEP
6:iz3SsE7Mvq22eApxArON2BORIBvuJKQmQ:w6MC2W/SORIBvuJ5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 532 1452 WerFault.exe 19 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1452 wrote to memory of 532 1452 b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe 26 PID 1452 wrote to memory of 532 1452 b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe 26 PID 1452 wrote to memory of 532 1452 b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe 26 PID 1452 wrote to memory of 532 1452 b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe"C:\Users\Admin\AppData\Local\Temp\b27dd49c14cd4f18284ca9eb0ab29c8da46272685e92178e2931f40ee2726874.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 882⤵
- Program crash
PID:532
-