Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
General
-
Target
12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe
-
Size
700KB
-
MD5
2699e44e641322f35f3844ade886a929
-
SHA1
42a8ca225c28c1dddc91cbe15ebc8c2fd69d377b
-
SHA256
12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed
-
SHA512
16a0f5692111f7382c4e95c85895d4b40d3981131b99ff6b56bdb01bf5a32f4cb1f0f249cd70ea204ff9e9a6544129f6a7aacc5a00e3590475a10c660399949b
-
SSDEEP
12288:mHXgFysVucQp1M/v2zZy/vpj+oyRhlkGUSwQh9e1r:Kg9x/vsLoIPUSwcK
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2092 set thread context of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 -
Program crash 2 IoCs
pid pid_target Process procid_target 2912 2092 WerFault.exe 16 2596 2620 WerFault.exe 32 -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2092 wrote to memory of 3068 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 29 PID 2092 wrote to memory of 3068 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 29 PID 2092 wrote to memory of 3068 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 29 PID 2092 wrote to memory of 3068 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 29 PID 2092 wrote to memory of 3068 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 29 PID 2092 wrote to memory of 3068 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 29 PID 2092 wrote to memory of 3068 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 29 PID 2092 wrote to memory of 3044 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 30 PID 2092 wrote to memory of 3044 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 30 PID 2092 wrote to memory of 3044 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 30 PID 2092 wrote to memory of 3044 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 30 PID 2092 wrote to memory of 3044 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 30 PID 2092 wrote to memory of 3044 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 30 PID 2092 wrote to memory of 3044 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 30 PID 2092 wrote to memory of 2612 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 31 PID 2092 wrote to memory of 2612 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 31 PID 2092 wrote to memory of 2612 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 31 PID 2092 wrote to memory of 2612 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 31 PID 2092 wrote to memory of 2612 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 31 PID 2092 wrote to memory of 2612 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 31 PID 2092 wrote to memory of 2612 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 31 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2620 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 32 PID 2092 wrote to memory of 2912 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 33 PID 2092 wrote to memory of 2912 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 33 PID 2092 wrote to memory of 2912 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 33 PID 2092 wrote to memory of 2912 2092 12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe 33 PID 2620 wrote to memory of 2596 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 2596 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 2596 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 2596 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 2596 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 2596 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 2596 2620 AppLaunch.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe"C:\Users\Admin\AppData\Local\Temp\12ceeab339c9f5c739fcc74d77971711040cf86466ec301448952c0c0ca314ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:3068
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:3044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2612
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 1963⤵
- Program crash
PID:2596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 1202⤵
- Program crash
PID:2912
-