Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 13:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23362bd82f2b728d9fa29aacb6cc5f63.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
23362bd82f2b728d9fa29aacb6cc5f63.exe
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
23362bd82f2b728d9fa29aacb6cc5f63.exe
-
Size
60KB
-
MD5
23362bd82f2b728d9fa29aacb6cc5f63
-
SHA1
8bfc38d809b223e6bce18598a574ded14d1e1fef
-
SHA256
bdc709694217d752a2d80c71ca3976ef60af24a037b7ee48f5aa363740dbab05
-
SHA512
da1acdab0f4298949cf71830113ca73fbd54713d25e8ad71d797a7cd4f0190540d3e1ca9715b949fcb35d6aca9ce42615ea16ec85dd767ff0ef69d051c84b9f6
-
SSDEEP
1536:eH7m1pcTY+rcKN2rnobvXWjy2rZDVmYtLYS:MOy2rhVV
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1016 set thread context of 1304 1016 23362bd82f2b728d9fa29aacb6cc5f63.exe 87 -
Program crash 1 IoCs
pid pid_target Process procid_target 4844 1304 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1304 1016 23362bd82f2b728d9fa29aacb6cc5f63.exe 87 PID 1016 wrote to memory of 1304 1016 23362bd82f2b728d9fa29aacb6cc5f63.exe 87 PID 1016 wrote to memory of 1304 1016 23362bd82f2b728d9fa29aacb6cc5f63.exe 87 PID 1016 wrote to memory of 1304 1016 23362bd82f2b728d9fa29aacb6cc5f63.exe 87 PID 1016 wrote to memory of 1304 1016 23362bd82f2b728d9fa29aacb6cc5f63.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe"C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe"C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe"2⤵PID:1304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 123⤵
- Program crash
PID:4844
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1304 -ip 13041⤵PID:376