Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe
Resource
win10v2004-20230915-en
General
-
Target
37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe
-
Size
1.1MB
-
MD5
7e945812a6d3a1e3f771a9f9184074d0
-
SHA1
bdba2479ffc2d5b27f9704ca40f7e03d5857f419
-
SHA256
37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9
-
SHA512
92f206d63eb1eb753ad0e5235279ab3143ce3ef85b1f97e9f9b801716f97817a9cfe5bfae08818dd7840852940357333f400e754bec9daf4d2d85fb9df43fc8b
-
SSDEEP
12288:Jls2wN2dA1IY9i4ytPrJx5ZVfV5TjzBTVyh43IubL5lne3sEtGJa8pzJcrKIrmcQ:Xs262dA1h9i4ytvV/3dH4GTarKIKcxA/
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3024 set thread context of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 -
Program crash 2 IoCs
pid pid_target Process procid_target 1728 3024 WerFault.exe 27 2012 2852 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 2852 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 29 PID 3024 wrote to memory of 1728 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 30 PID 3024 wrote to memory of 1728 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 30 PID 3024 wrote to memory of 1728 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 30 PID 3024 wrote to memory of 1728 3024 37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe 30 PID 2852 wrote to memory of 2012 2852 AppLaunch.exe 31 PID 2852 wrote to memory of 2012 2852 AppLaunch.exe 31 PID 2852 wrote to memory of 2012 2852 AppLaunch.exe 31 PID 2852 wrote to memory of 2012 2852 AppLaunch.exe 31 PID 2852 wrote to memory of 2012 2852 AppLaunch.exe 31 PID 2852 wrote to memory of 2012 2852 AppLaunch.exe 31 PID 2852 wrote to memory of 2012 2852 AppLaunch.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe"C:\Users\Admin\AppData\Local\Temp\37abdcb8f25a5e1e59a5b5db52b82dd57cde0bf20da53090a16ad9d5ca96c7d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1963⤵
- Program crash
PID:2012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 922⤵
- Program crash
PID:1728
-