Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2023, 14:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Microsoft Exchange Services Health.exe
Resource
win7-20230220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Microsoft Exchange Services Health.exe
Resource
win10v2004-20230220-en
5 signatures
150 seconds
General
-
Target
Microsoft Exchange Services Health.exe
-
Size
30KB
-
MD5
4b079c6c0c25d81c65c94f502f4bd148
-
SHA1
53ae850bdbdead557255e0d0a5a7fc0b6d119c45
-
SHA256
2fd6984975fe63d3299e1aab2220d15445ea5509e7ae9f308828b01db63b4996
-
SHA512
955bec03df5b6f2fb8c05aad91d3ca54d2695ec129f355aead5a917a865c3dc977d6299571c73ed029a85bf500684b40c6f65e93b97860e219caa23041c1060f
-
SSDEEP
768:hEHZnhI0GaRHV/RWM41v1BbpChP1o2gm3Htd:hEHZjetM5LX3v
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1700 1980 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1700 1980 Microsoft Exchange Services Health.exe 28 PID 1980 wrote to memory of 1700 1980 Microsoft Exchange Services Health.exe 28 PID 1980 wrote to memory of 1700 1980 Microsoft Exchange Services Health.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Exchange Services Health.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Exchange Services Health.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1980 -s 5402⤵
- Program crash
PID:1700
-