Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/02/2023, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
00000000.exe
Resource
win7-20221111-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
00000000.exe
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
00000000.exe
-
Size
7KB
-
MD5
f28cc09c077e067d36f7f69629ee6297
-
SHA1
bebb8b40f38f66df1644edee949adecb474fb9b7
-
SHA256
19fa93805291d9f16dc348ea35300aeb6ffd9bbee855948fa351c6c6791fc821
-
SHA512
20bab9ef2c31f8e40ef92ae8683ed7672e28da854aa1e9b855ec1cf6a7ac893a2fbc10a318f12140a9cc6b3b9caa26e391d610527e71da53e91370069f997b71
-
SSDEEP
96:+wph816+leOL2LPQYHFZiQBq58xY+s6koCvP9ZdxzNt:Bph816+leOSrQYHLZI58e+sHo4rJ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1736 1216 WerFault.exe 2 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1216 00000000.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1216 wrote to memory of 1736 1216 00000000.exe 28 PID 1216 wrote to memory of 1736 1216 00000000.exe 28 PID 1216 wrote to memory of 1736 1216 00000000.exe 28 PID 1216 wrote to memory of 1736 1216 00000000.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\00000000.exe"C:\Users\Admin\AppData\Local\Temp\00000000.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 12002⤵
- Program crash
PID:1736
-