Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 21:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04cf3e24e13dfc16d29ee71bfa34aff9.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
04cf3e24e13dfc16d29ee71bfa34aff9.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
04cf3e24e13dfc16d29ee71bfa34aff9.exe
-
Size
127KB
-
MD5
04cf3e24e13dfc16d29ee71bfa34aff9
-
SHA1
7d2871ef71b5bb062e7679f4ca41a7fae3846a34
-
SHA256
1aad8bd2f38ffc2ba001bc1a2819c89cd1d48d6b74b1f40bfc5863be8c262289
-
SHA512
edc87f7850a9a9dd9af169fed5248605a1e9914e8f4700bb6d9ca855b8a9f270e3b4bfd6600ace3d9b59bd322349b0f615e7c8ba11a89bde4c79fa08b60fd24e
-
SSDEEP
3072:zsoty+25DigTUCTkgqsQ93l21LHP2DqeIP/pNqsQiAMF:zb94rTkkQu0tIX/qs
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 1956 1740 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1956 1740 04cf3e24e13dfc16d29ee71bfa34aff9.exe 14 PID 1740 wrote to memory of 1956 1740 04cf3e24e13dfc16d29ee71bfa34aff9.exe 14 PID 1740 wrote to memory of 1956 1740 04cf3e24e13dfc16d29ee71bfa34aff9.exe 14 PID 1740 wrote to memory of 1956 1740 04cf3e24e13dfc16d29ee71bfa34aff9.exe 14
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1881⤵
- Program crash
PID:1956
-
C:\Users\Admin\AppData\Local\Temp\04cf3e24e13dfc16d29ee71bfa34aff9.exe"C:\Users\Admin\AppData\Local\Temp\04cf3e24e13dfc16d29ee71bfa34aff9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740