Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
133s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
05/10/2023, 09:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe
Resource
win10-20230915-en
2 signatures
150 seconds
General
-
Target
6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe
-
Size
427KB
-
MD5
00db3e5c86df70cda3df5cd168572834
-
SHA1
b79d36218b68b06950d4d42fa66db0f8e78b4fd2
-
SHA256
6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339
-
SHA512
b61fbd9851d0a39b01bbdd7b6a5af6d7ef642e8a3474c78b460ea2379121820827ea5718fc467618d6b482b55375dca38e9ad35abe6097265b7e1a8e6005b319
-
SSDEEP
12288:EFjChvXpPdHSF64iODO+7L5vOAKF17YGsa2O:Eg5PZSFhBDO+EAiYGsa2O
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4900 2984 WerFault.exe 69 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2984 wrote to memory of 1940 2984 6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe 70 PID 2984 wrote to memory of 1940 2984 6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe 70 PID 2984 wrote to memory of 1940 2984 6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe"C:\Users\Admin\AppData\Local\Temp\6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe"C:\Users\Admin\AppData\Local\Temp\6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339.exe"2⤵PID:1940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 8922⤵
- Program crash
PID:4900
-