Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
13/11/2023, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe
Resource
win7-20231020-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe
Resource
win10v2004-20231020-en
7 signatures
150 seconds
General
-
Target
NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe
-
Size
62KB
-
MD5
bd61caecd07dc2f7f01f8c300cc2d950
-
SHA1
26cc7768883c9d5b9255acdfc96877598c61d700
-
SHA256
203607ab406122309a15e5030a760a940481c499410e051b34a17a13cf79f4c8
-
SHA512
3be41a1aa0a9b1ce4b1c7c377df1ea61eeced9b312d18fce7f5603e0abb7ba7a2b04e5202942a62877d4cfaa8e69869dbac8a73948b5bb317441df04285c7749
-
SSDEEP
1536:CfE5CscPP7rRztz+wTQ5KTDIkRTjku5PIOQEJ7:ME5CsOPvDnQsTDIkRTj5xIOQG7
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2976 2460 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2976 2460 NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe 28 PID 2460 wrote to memory of 2976 2460 NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe 28 PID 2460 wrote to memory of 2976 2460 NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe 28 PID 2460 wrote to memory of 2976 2460 NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.bd61caecd07dc2f7f01f8c300cc2d950.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 362⤵
- Program crash
PID:2976
-