Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 09:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
644073bd6d88506db27f09293f8b269b.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
644073bd6d88506db27f09293f8b269b.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
644073bd6d88506db27f09293f8b269b.exe
-
Size
716KB
-
MD5
644073bd6d88506db27f09293f8b269b
-
SHA1
8b60e42f080cf00e0182dcb3fed45d2aaedd8d99
-
SHA256
8172a6faec609addf0bf63a87b52dff0f638aa11d0f3676ad8fe431b62271a2c
-
SHA512
db4f212cb1307f200dc2895f23fce88a2fb58287206bf8cab3adc1979ec91d04ed369cd1778cfbe4df3ea96b4fa5f6694fe8113ce21855e57d99ac627c4ca90c
-
SSDEEP
12288:PkFDob8apwzzU/KoV534/SYNVbY/2ToCfD4cxDnz1BhhP9bEIVQq183ewyxodLko:cF8Qzwic4SgY/EfMctbh9RBo
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1160 1736 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1160 1736 644073bd6d88506db27f09293f8b269b.exe 16 PID 1736 wrote to memory of 1160 1736 644073bd6d88506db27f09293f8b269b.exe 16 PID 1736 wrote to memory of 1160 1736 644073bd6d88506db27f09293f8b269b.exe 16 PID 1736 wrote to memory of 1160 1736 644073bd6d88506db27f09293f8b269b.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\644073bd6d88506db27f09293f8b269b.exe"C:\Users\Admin\AppData\Local\Temp\644073bd6d88506db27f09293f8b269b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 362⤵
- Program crash
PID:1160
-