Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 03:22
Behavioral task
behavioral1
Sample
NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe
Resource
win7-20231020-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe
Resource
win10v2004-20231023-en
1 signatures
150 seconds
General
-
Target
NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe
-
Size
143KB
-
MD5
ebaea2d058f6922268dbe0fdabe6e6e0
-
SHA1
ce2a24338fa2303f636c9e097e6635320c0f10a0
-
SHA256
ecbf19defbe34778b0ff70bc164310dbb3cda6889d90f9613fc98e5bce074445
-
SHA512
f29b2e994ec0a2242e30bf79e302697b805a211f732d2786ed95e7566c9443140901698773880fb503471f5351913c562ecd3a114d5e0628a2cd1d5a9193f063
-
SSDEEP
3072:o+HcL2mCfiTntqSQRruiMZMqqDL2/AwvdL7Vjp9:hIDtORruiMyqqDL6tvdxp9
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2028 2040 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2028 2040 NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe 28 PID 2040 wrote to memory of 2028 2040 NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe 28 PID 2040 wrote to memory of 2028 2040 NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe 28 PID 2040 wrote to memory of 2028 2040 NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 882⤵
- Program crash
PID:2028
-