Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16c6cb2349cb410cf3a78de8fcc3c688.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
16c6cb2349cb410cf3a78de8fcc3c688.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
16c6cb2349cb410cf3a78de8fcc3c688.exe
-
Size
507KB
-
MD5
16c6cb2349cb410cf3a78de8fcc3c688
-
SHA1
0b6ad78f4cecf86165009fcac9575bff873391c3
-
SHA256
5ecd27eac1d60ef9a4fb6c937ce2687d31e636888421e493e2acd6cfeccaba8c
-
SHA512
6733948d2eee53f93b23051bd38cf9a6994c103ea1023460fabd0ed56ef22118bef276c1e207bc79d2541ac849e20107f6c44602220bdb63afd0b2fb3124316d
-
SSDEEP
12288:+9Ogm5KlXU+vF8kM3+HkRTLEPMsmstvxrelk:8vm5WFF8ki+HgTL1smstvxr0k
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 632 2880 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2880 wrote to memory of 632 2880 16c6cb2349cb410cf3a78de8fcc3c688.exe 14 PID 2880 wrote to memory of 632 2880 16c6cb2349cb410cf3a78de8fcc3c688.exe 14 PID 2880 wrote to memory of 632 2880 16c6cb2349cb410cf3a78de8fcc3c688.exe 14 PID 2880 wrote to memory of 632 2880 16c6cb2349cb410cf3a78de8fcc3c688.exe 14
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1241⤵
- Program crash
PID:632
-
C:\Users\Admin\AppData\Local\Temp\16c6cb2349cb410cf3a78de8fcc3c688.exe"C:\Users\Admin\AppData\Local\Temp\16c6cb2349cb410cf3a78de8fcc3c688.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880