Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe
-
Size
700KB
-
MD5
265865b23c843a7176855fa5a64dcc36
-
SHA1
b13a5e8d7045da867ab8640869afb8ef55810580
-
SHA256
9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2
-
SHA512
50b948bc09719aeec7dff9b3b3bb1338816cf9eebba9dad7a72782e72f5613a3e8c7207c3861483fcac8f7186c86a2c663b95b2ee7436b5ebccfbae5676efe43
-
SSDEEP
6144:u6vGALXgBEIy8wluzNcq/PVucQp7639A2285aEjZyugWWSYttRdvfr:PHXgFysVucQp7y9A2xZtUttfr
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2120 set thread context of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 -
Program crash 2 IoCs
pid pid_target Process procid_target 2636 2120 WerFault.exe 27 2700 1304 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 1304 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 29 PID 2120 wrote to memory of 2636 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 30 PID 2120 wrote to memory of 2636 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 30 PID 2120 wrote to memory of 2636 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 30 PID 2120 wrote to memory of 2636 2120 9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe 30 PID 1304 wrote to memory of 2700 1304 AppLaunch.exe 31 PID 1304 wrote to memory of 2700 1304 AppLaunch.exe 31 PID 1304 wrote to memory of 2700 1304 AppLaunch.exe 31 PID 1304 wrote to memory of 2700 1304 AppLaunch.exe 31 PID 1304 wrote to memory of 2700 1304 AppLaunch.exe 31 PID 1304 wrote to memory of 2700 1304 AppLaunch.exe 31 PID 1304 wrote to memory of 2700 1304 AppLaunch.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe"C:\Users\Admin\AppData\Local\Temp\9067ac751510f83f7767b9cbac7c805d58d5d29bab73683832d6f36226dce3d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1963⤵
- Program crash
PID:2700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 922⤵
- Program crash
PID:2636
-