Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 07:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.d494dd7be36ab7c6936b960e62facb00.exe
Resource
win7-20231020-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.d494dd7be36ab7c6936b960e62facb00.exe
Resource
win10v2004-20231023-en
1 signatures
150 seconds
General
-
Target
NEAS.d494dd7be36ab7c6936b960e62facb00.exe
-
Size
208KB
-
MD5
d494dd7be36ab7c6936b960e62facb00
-
SHA1
909afab61f5f52e100230447fb49db51dea97c1b
-
SHA256
62c261115b7ca6d787661523408d8bc86ec52102637151a8a8f34c4804d2b68b
-
SHA512
ef4c738d35c404455b97f7434c3b80c8f612d27493c5beccf1f2e5ceccd98627f85f7d0eabd4ece6e804c2882f4086f2db0f3cdabd22ce94714db86c9cda7e3c
-
SSDEEP
768:TpMeEXxR3F8UNvrJb0PztsYDpVLGc3HZWok/6pSyHkSyTrT/1H55Xdnh:TqzXF8CvrJ4PBhDP35RlahJ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2284 2408 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2284 2408 NEAS.d494dd7be36ab7c6936b960e62facb00.exe 28 PID 2408 wrote to memory of 2284 2408 NEAS.d494dd7be36ab7c6936b960e62facb00.exe 28 PID 2408 wrote to memory of 2284 2408 NEAS.d494dd7be36ab7c6936b960e62facb00.exe 28 PID 2408 wrote to memory of 2284 2408 NEAS.d494dd7be36ab7c6936b960e62facb00.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d494dd7be36ab7c6936b960e62facb00.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d494dd7be36ab7c6936b960e62facb00.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 362⤵
- Program crash
PID:2284
-