Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29/08/2023, 21:39
Static task
static1
Behavioral task
behavioral1
Sample
301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe
Resource
win10v2004-20230703-en
General
-
Target
301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe
-
Size
12.4MB
-
MD5
80e90ed82a13fdb58d42b4feadd21ce6
-
SHA1
74f9e80cd168c1915f1e1fb4a496035643c738d9
-
SHA256
301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87
-
SHA512
86afb3a050c99c31d11f45d78d8d0423acf6895d370d9adee3316a95c08278427ac2c863dca5d77b81b25a1c2064c8b07e7c509dc16f8d89237919cd8aee4c04
-
SSDEEP
196608:buYV0ems0ywcJfey+8CfXIFKpdqC7MRPOZCTvcL/U4ypZ1jHu0ZcYj/s5ETXWtDt:6Y29Zy+BQAn57MfQAL9HuEZj0IGxS
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1048 2080 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1048 2080 301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe 29 PID 2080 wrote to memory of 1048 2080 301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe 29 PID 2080 wrote to memory of 1048 2080 301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe 29 PID 2080 wrote to memory of 1048 2080 301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe"C:\Users\Admin\AppData\Local\Temp\301b006e51026b1412df7eed0c8030da5c701032e520655eb6eaa899060ced87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 2762⤵
- Program crash
PID:1048
-