Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10985196a6ca...88.exe
windows7-x64
3985196a6ca...88.exe
windows10-2004-x64
3ca7bca7285...84.exe
windows7-x64
1ca7bca7285...84.exe
windows10-2004-x64
3e8c962d87f...8c.exe
windows7-x64
3e8c962d87f...8c.exe
windows10-2004-x64
3f8b04b38e2...22.exe
windows7-x64
3f8b04b38e2...22.exe
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 07:47
Behavioral task
behavioral1
Sample
985196a6cae060e6c03f8c8cc506303ad5d717bf44c4985e6267148c02f59188.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
985196a6cae060e6c03f8c8cc506303ad5d717bf44c4985e6267148c02f59188.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
ca7bca7285aec72cc48a9d82390d5b84f99b84c5989f69f45b9453ae3bc37284.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
ca7bca7285aec72cc48a9d82390d5b84f99b84c5989f69f45b9453ae3bc37284.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
f8b04b38e2c941657114b67a47aee8993a3f0d7e080eeb31fb681bf360546722.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
f8b04b38e2c941657114b67a47aee8993a3f0d7e080eeb31fb681bf360546722.exe
Resource
win10v2004-20230915-en
General
-
Target
e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe
-
Size
408KB
-
MD5
3b8e7fa4a1310534e87c342dd2d810e2
-
SHA1
ffe4f11e07120fd6614b555707ae13670f8301f5
-
SHA256
e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c
-
SHA512
b7774aa680ac8722391a5b3696b6048fa9c82cbeb5596bce6b4bd99a35e8ddf229302af5c32df11dad9deb47210084b03cbe101fe2c376a3ed162af063ee7d83
-
SSDEEP
12288:fRsXXRYJNDOIUuyoWxgXa/jkrX6ZysBfBd3V7Dsw:fR1XFUuDsgXa/jkrX6YwBdq
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2652 2456 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2652 2456 e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe 28 PID 2456 wrote to memory of 2652 2456 e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe 28 PID 2456 wrote to memory of 2652 2456 e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe 28 PID 2456 wrote to memory of 2652 2456 e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe"C:\Users\Admin\AppData\Local\Temp\e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 7682⤵
- Program crash
PID:2652
-