Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
16/11/2023, 23:40 UTC
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.be13db078532f6fb7790d497ba5a65e0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.be13db078532f6fb7790d497ba5a65e0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.be13db078532f6fb7790d497ba5a65e0.exe
-
Size
208KB
-
MD5
be13db078532f6fb7790d497ba5a65e0
-
SHA1
bf388c137d8a630db34106c7db2292256c6579e8
-
SHA256
82a06f189230654e5be3d56a752ed933ba9ed6092bd48a2053049f9a89688acd
-
SHA512
0ae3e133415f792408c422a4468c0bfd2a377101d53124d1b237fe45df71e5084aa59fb5dedc4143beec3409d55bd5015cff4c6cf19a681370d915b1ca1eafb1
-
SSDEEP
768:C6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQekDPN0U02p/1H50FXdnhfepXdnh:1ccYH/Gnc+hmlJQekDFT02L2wL
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2104 2168 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2104 2168 NEAS.be13db078532f6fb7790d497ba5a65e0.exe 28 PID 2168 wrote to memory of 2104 2168 NEAS.be13db078532f6fb7790d497ba5a65e0.exe 28 PID 2168 wrote to memory of 2104 2168 NEAS.be13db078532f6fb7790d497ba5a65e0.exe 28 PID 2168 wrote to memory of 2104 2168 NEAS.be13db078532f6fb7790d497ba5a65e0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.be13db078532f6fb7790d497ba5a65e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.be13db078532f6fb7790d497ba5a65e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 362⤵
- Program crash
PID:2104
-