Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
76s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 13:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.219900ce655a7f342fc4dd369b88acc0.exe
Resource
win7-20231023-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.219900ce655a7f342fc4dd369b88acc0.exe
Resource
win10v2004-20231023-en
2 signatures
150 seconds
General
-
Target
NEAS.219900ce655a7f342fc4dd369b88acc0.exe
-
Size
188KB
-
MD5
219900ce655a7f342fc4dd369b88acc0
-
SHA1
a0ab8b5de14513378ca900639ab7ce6ccf35cb93
-
SHA256
908cf4765a7891dde70b7894eca85fe2846f04d3348dfb380840cbfe51af707f
-
SHA512
3ccb37dba62fbf1d8de26375e46878edbf39ee7f45584d3c9d280da9800947d2784350028fc9283d5ce8704284e5b08f67c6835ab640cb84924d9f242293cf92
-
SSDEEP
768:1OwyxiCz6vYkvFjHE8juLRjafwToWoDgCJzguySwJhi0/1H54/:1+ACIYkva8qVjafwTtxKsuCX6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2764 2692 WerFault.exe 5 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2764 2692 NEAS.219900ce655a7f342fc4dd369b88acc0.exe 29 PID 2692 wrote to memory of 2764 2692 NEAS.219900ce655a7f342fc4dd369b88acc0.exe 29 PID 2692 wrote to memory of 2764 2692 NEAS.219900ce655a7f342fc4dd369b88acc0.exe 29 PID 2692 wrote to memory of 2764 2692 NEAS.219900ce655a7f342fc4dd369b88acc0.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.219900ce655a7f342fc4dd369b88acc0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.219900ce655a7f342fc4dd369b88acc0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 362⤵
- Program crash
PID:2764
-