Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 00:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c6345aa3efd7ea012ac7f9be52f1569.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c6345aa3efd7ea012ac7f9be52f1569.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
1c6345aa3efd7ea012ac7f9be52f1569.exe
-
Size
8KB
-
MD5
1c6345aa3efd7ea012ac7f9be52f1569
-
SHA1
a0a07e370fc53b649ca8e9ddd3521d6c046773d8
-
SHA256
bdde831dea6f3b6d5c1a34e7d18306d7feed666dcf50a14ce727b970163175f5
-
SHA512
a3f8fd8e86bc012965a356ae491abe00a8ef98851dbca0a396ab7b191972e2322202baba3df3857cb5404f8b4a5c89f5efda3d5267acf55a026067f09b62dedb
-
SSDEEP
48:OEPxQovclICkfGOLgdpVmSUQlXMjM8O/2fb/ayAH3PvhIB6pT:nP2ovclqGOcdpMacj5O/weycvuQpT
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 2500 1192 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1192 wrote to memory of 2500 1192 1c6345aa3efd7ea012ac7f9be52f1569.exe 14 PID 1192 wrote to memory of 2500 1192 1c6345aa3efd7ea012ac7f9be52f1569.exe 14 PID 1192 wrote to memory of 2500 1192 1c6345aa3efd7ea012ac7f9be52f1569.exe 14 PID 1192 wrote to memory of 2500 1192 1c6345aa3efd7ea012ac7f9be52f1569.exe 14
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 361⤵
- Program crash
PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1c6345aa3efd7ea012ac7f9be52f1569.exe"C:\Users\Admin\AppData\Local\Temp\1c6345aa3efd7ea012ac7f9be52f1569.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1192