Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
37s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe
Resource
win10v2004-20220812-en
General
-
Target
f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe
-
Size
272KB
-
MD5
0659d688de76f2757909b294db2fa780
-
SHA1
331ff058c0391febc180d5f2da551822cd358d4b
-
SHA256
f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e
-
SHA512
c99e691dcede4b05df7899eab214b96bb15884b2009023de11d0e3e78cf0f570b84c363cb052adc21fedaa96ccdd833c78076db17db69d428814d9e94e71b792
-
SSDEEP
6144:hvljJrfB3+powwq+xE7OqLVJ5bbZXegqw48gyH0YtnbvK/kFZj:hNjJrp3JBqsEaWJtbZU8JFtrymB
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 860 1712 WerFault.exe 20 -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1712 wrote to memory of 860 1712 f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe 27 PID 1712 wrote to memory of 860 1712 f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe 27 PID 1712 wrote to memory of 860 1712 f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe 27 PID 1712 wrote to memory of 860 1712 f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe 27 PID 1712 wrote to memory of 860 1712 f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe 27 PID 1712 wrote to memory of 860 1712 f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe 27 PID 1712 wrote to memory of 860 1712 f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe"C:\Users\Admin\AppData\Local\Temp\f24486b0eefe0ae5af1b5e705b673ffff4c3023c17a2b34e3ee78c384afb227e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 2562⤵
- Program crash
PID:860
-