Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
21/10/2023, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe
-
Size
66KB
-
MD5
ed5b368b8311fd5c6dd1920a3895c740
-
SHA1
30075a79cd54b505dc5aa3242f6181d59a5780a7
-
SHA256
f20f2db9cc29a0fe55bee155a8c40913c28887b4d752b64d0c7187358739f7ac
-
SHA512
3f8c68bb262ea84940c6d315f54b4930f225c4648c0509ea234e74a579b422cdb246cac2bc8ea9fe22e86aafc29fd3d3a9631be13953d03b8e15d87b26f9dcc8
-
SSDEEP
768:vQFSrugMRYYRRFsz4aBU3ajU39oJLFBGG0tNeG97beETVi0vplfK+fPyOXW4w2Aq:riVsnU3GF0G0tUCeE5Txfin/m
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1964 2056 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1964 2056 NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe 28 PID 2056 wrote to memory of 1964 2056 NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe 28 PID 2056 wrote to memory of 1964 2056 NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe 28 PID 2056 wrote to memory of 1964 2056 NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 362⤵
- Program crash
PID:1964
-