Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
13/01/2023, 13:52
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
file.exe
-
Size
3.5MB
-
MD5
6a132fec0229a82f641efd9f2b489348
-
SHA1
e54f7f270f155e813adcb1adbbd8b0d310c790d5
-
SHA256
91b5dd1d3b3389471526471e7bbd23f70c9a94ce73733e21b8c7f99a6b3a6d1d
-
SHA512
428438a50d4d937e5e4cb0118882c1ad8c979ee838a8220c4e2f74ed902113478f75c1c1c1db8702f3cb76c88a9cdc08bda40670d15b62d37b7fd4efe282045c
-
SSDEEP
49152:dJTO65WNj2rPLwdimBGEFcGvC+ox09wQ3sx9axS/k+XQlPWR9KuaDCXq1j9aRL2W:/S6rUgQBcVlcwQcxsxScS/TQYCIplP
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/832-54-0x0000000140000000-0x000000014061B000-memory.dmp vmprotect -
Program crash 1 IoCs
pid pid_target Process procid_target 1200 832 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 832 wrote to memory of 1200 832 file.exe 28 PID 832 wrote to memory of 1200 832 file.exe 28 PID 832 wrote to memory of 1200 832 file.exe 28