Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:03
Behavioral task
behavioral1
Sample
5e3e46cb59a050a1f66bd0dbc8ffa294.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e3e46cb59a050a1f66bd0dbc8ffa294.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
5e3e46cb59a050a1f66bd0dbc8ffa294.exe
-
Size
673KB
-
MD5
5e3e46cb59a050a1f66bd0dbc8ffa294
-
SHA1
2b29fc9b3c81be9d6e913f9b9859fd5de3225b88
-
SHA256
71c8a2244f7f41437f63186040457ca975acc29cb91df68060deef53ac572eee
-
SHA512
06ab23c0eab746461f8af94fedc1533cad6b4ffb3cbc8458d9f1d29c8b867b34a04794a0befb0c4d04264b3382ad96e17b0132546b436a4c8030e204aa7d82bc
-
SSDEEP
12288:yoeewslITBd47GLRMTb7bDgFX8vwq2VWS9YuJp5n+DOZ:veHslGd474mf7bDAX8v54dYur5nMOZ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2996 3044 WerFault.exe 1 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2932 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 19 PID 3044 wrote to memory of 2932 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 19 PID 3044 wrote to memory of 2932 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 19 PID 3044 wrote to memory of 2932 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 19 PID 3044 wrote to memory of 2932 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 19 PID 3044 wrote to memory of 2932 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 19 PID 3044 wrote to memory of 2932 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 19 PID 3044 wrote to memory of 2996 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 18 PID 3044 wrote to memory of 2996 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 18 PID 3044 wrote to memory of 2996 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 18 PID 3044 wrote to memory of 2996 3044 5e3e46cb59a050a1f66bd0dbc8ffa294.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e3e46cb59a050a1f66bd0dbc8ffa294.exe"C:\Users\Admin\AppData\Local\Temp\5e3e46cb59a050a1f66bd0dbc8ffa294.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1922⤵
- Program crash
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\5e3e46cb59a050a1f66bd0dbc8ffa294.exeC:\Users\Admin\AppData\Local\Temp/5e3e46cb59a050a1f66bd0dbc8ffa294.exe2⤵PID:2932
-