Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d1fe64c314f6b90c003dec415e38bae.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d1fe64c314f6b90c003dec415e38bae.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2d1fe64c314f6b90c003dec415e38bae.exe
-
Size
387KB
-
MD5
2d1fe64c314f6b90c003dec415e38bae
-
SHA1
80c946d29034713715e6d4a763691f693bf28cb1
-
SHA256
4f869d72a2b869b7dc8d5d39924b8b714c9d3776a37f67d56f8f93728e645957
-
SHA512
854fa749d09e128629aa3f60986be24a93523ee3ee4357222ac7d014f81906d9cd1f0c6a4f529022a1eab665b4a0b2e2f87b23ae1a5b5632899a6e3768d60941
-
SSDEEP
12288:UfSNDGoVZvUiJc4ymIlm2mgChpHRNe1rl8o9SgE:31xJc41IU2mfhpxNSlNUN
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 404 2424 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2424 wrote to memory of 396 2424 2d1fe64c314f6b90c003dec415e38bae.exe 23 PID 2424 wrote to memory of 396 2424 2d1fe64c314f6b90c003dec415e38bae.exe 23 PID 2424 wrote to memory of 396 2424 2d1fe64c314f6b90c003dec415e38bae.exe 23
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d1fe64c314f6b90c003dec415e38bae.exe"C:\Users\Admin\AppData\Local\Temp\2d1fe64c314f6b90c003dec415e38bae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 3642⤵
- Program crash
PID:404
-
-
C:\Users\Admin\AppData\Local\Temp\2d1fe64c314f6b90c003dec415e38bae.exe"C:\Users\Admin\AppData\Local\Temp\2d1fe64c314f6b90c003dec415e38bae.exe"2⤵PID:396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2424 -ip 24241⤵PID:3360