Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
17/11/2023, 01:30
Behavioral task
behavioral1
Sample
NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe
Resource
win7-20231020-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe
Resource
win10v2004-20231023-en
1 signatures
150 seconds
General
-
Target
NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe
-
Size
264KB
-
MD5
e77d68a2e8e77cc1b8cf5f9f9227f320
-
SHA1
38ea3a86779a5451b505acc8c9499b083e5ebe6b
-
SHA256
619a590c46d04816e983a3caeab59c861cebec8e65133464477c4e642a8ea63a
-
SHA512
615e4909cce725f1d8e23e4b5c9dca2629ca176e05a663070b049007d2b940a996d96173a14aa0f7a3156b17ca5143430267c29a606efe675d46521b4757e86b
-
SSDEEP
1536:PvzXF8CvrJ4PBhDP35RJdeqVQdgy2df7kcaEBaWMKAmpw9mo7:3h8k6DP3bDeqV4gyufh4gAmpw9mo
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2364 2132 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2364 2132 NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe 28 PID 2132 wrote to memory of 2364 2132 NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe 28 PID 2132 wrote to memory of 2364 2132 NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe 28 PID 2132 wrote to memory of 2364 2132 NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 362⤵
- Program crash
PID:2364
-