Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
254s -
max time network
316s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 00:15
Behavioral task
behavioral1
Sample
3012-2-0x0000000000400000-0x0000000002083000-memory.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
3012-2-0x0000000000400000-0x0000000002083000-memory.exe
-
Size
28.5MB
-
MD5
ad874e2a16b35870d60f98cef1d0bbdc
-
SHA1
be8a7b9ce4c2a5dbca6bda6d0d99dd8e2ac7ced8
-
SHA256
081502b51bbf721cde13002a3a8704c3eddf22c04cdcd29abbf9c78c1b80a2d1
-
SHA512
5d12ee305e8fc749c398a4858a0cf691889446d9fd205b35da5e1d1cb7046d9c33d9d9e3f0d314ce4beaf5ded600e9221af9bd37e914596770e5224e217554d9
-
SSDEEP
3072:3ixkPwbpTK8Q5Uzf4JElJvIT43uFRqqL:SxmwbJKAzAElJA8UB
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2744 2728 WerFault.exe 16 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2744 2728 3012-2-0x0000000000400000-0x0000000002083000-memory.exe 26 PID 2728 wrote to memory of 2744 2728 3012-2-0x0000000000400000-0x0000000002083000-memory.exe 26 PID 2728 wrote to memory of 2744 2728 3012-2-0x0000000000400000-0x0000000002083000-memory.exe 26 PID 2728 wrote to memory of 2744 2728 3012-2-0x0000000000400000-0x0000000002083000-memory.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\3012-2-0x0000000000400000-0x0000000002083000-memory.exe"C:\Users\Admin\AppData\Local\Temp\3012-2-0x0000000000400000-0x0000000002083000-memory.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 362⤵
- Program crash
PID:2744
-