Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/08/2023, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe
Resource
win10v2004-20230703-en
General
-
Target
444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe
-
Size
4.6MB
-
MD5
bf36192f72d843272022119bc329f1e2
-
SHA1
d8d6254fce370a7182e53f2f9ebace8c4c443f28
-
SHA256
444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f
-
SHA512
3e67f8afd55109c0973c096742c1ccea78d5c28c4208899f65a0c67e24cb81d0d95989d71a088ecbaa39f22d144d31edbff9d7692782c39b26f08c7d7e30e429
-
SSDEEP
24576:H+MTkmA2t+FJj7NjEOSjiR6x44cGHvFN4RTIZ09Bx:ePj+OIx4FlJx
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1228 1136 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1136 wrote to memory of 1228 1136 444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe 28 PID 1136 wrote to memory of 1228 1136 444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe 28 PID 1136 wrote to memory of 1228 1136 444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe 28 PID 1136 wrote to memory of 1228 1136 444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe"C:\Users\Admin\AppData\Local\Temp\444d7c841fc2d89268be1e29a08f6b13858ecdc6c72d1861f7f73022862a320f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 362⤵
- Program crash
PID:1228
-