Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
055a4c82658aa233c9b223a0e44abfb2.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
055a4c82658aa233c9b223a0e44abfb2.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
055a4c82658aa233c9b223a0e44abfb2.exe
-
Size
584KB
-
MD5
055a4c82658aa233c9b223a0e44abfb2
-
SHA1
e662c0491f0c511739a14d6038e0e9b4ab64a4e7
-
SHA256
4e4b4bd204eeb1706cdafad2ba56096cf2bdc2acc6a40ba84c3f9e9872499383
-
SHA512
eaec1dbcd8924c6b8be0cdc63e5fe07ee4193020d26b7f63af69d20bfd8d82ca4f9d1903354a616de2f719329682f68c0177aba2b37c825cd0d3a165b89d4109
-
SSDEEP
12288:IfioJ27f8GH4tNODBnXQRDpxS1c2obY7h1YcE9Zhi7B0prye5:6zGHGODIxAoclehi7uprye5
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2708 1456 WerFault.exe 8 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1456 055a4c82658aa233c9b223a0e44abfb2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1456 wrote to memory of 2708 1456 055a4c82658aa233c9b223a0e44abfb2.exe 28 PID 1456 wrote to memory of 2708 1456 055a4c82658aa233c9b223a0e44abfb2.exe 28 PID 1456 wrote to memory of 2708 1456 055a4c82658aa233c9b223a0e44abfb2.exe 28 PID 1456 wrote to memory of 2708 1456 055a4c82658aa233c9b223a0e44abfb2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\055a4c82658aa233c9b223a0e44abfb2.exe"C:\Users\Admin\AppData\Local\Temp\055a4c82658aa233c9b223a0e44abfb2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 2922⤵
- Program crash
PID:2708
-