Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
556740e5bdc0bdbe4d88278c37c5cd22.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
556740e5bdc0bdbe4d88278c37c5cd22.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
556740e5bdc0bdbe4d88278c37c5cd22.exe
-
Size
55KB
-
MD5
556740e5bdc0bdbe4d88278c37c5cd22
-
SHA1
addbb276d7b6c445d0514c3b98b0ab0b2c0221eb
-
SHA256
884d4831c94a9bb5ed76f2f45ec14a6691a3e25fa86ca6616a4f2d139645d3e1
-
SHA512
a0f81d78ae93d8d72b66f9df734260ff53d54a0dd3737e0ddd3fe330b86f045eefcb96026932fc48c7eb3fd3f5622762d7f8ad79dbdf5bddb71b16d956f19f22
-
SSDEEP
384:CLSzLeunmBjr9dN7mjpIBPEyEr/gDxrrrDp7VbbFaDrrrfOqvspSDwGmU/IQm:cSzLpmdN7KkDo7wGd/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2052 2168 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2052 2168 556740e5bdc0bdbe4d88278c37c5cd22.exe 29 PID 2168 wrote to memory of 2052 2168 556740e5bdc0bdbe4d88278c37c5cd22.exe 29 PID 2168 wrote to memory of 2052 2168 556740e5bdc0bdbe4d88278c37c5cd22.exe 29 PID 2168 wrote to memory of 2052 2168 556740e5bdc0bdbe4d88278c37c5cd22.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\556740e5bdc0bdbe4d88278c37c5cd22.exe"C:\Users\Admin\AppData\Local\Temp\556740e5bdc0bdbe4d88278c37c5cd22.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 722⤵
- Program crash
PID:2052
-