Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 23:12
Behavioral task
behavioral1
Sample
0699bcd46158669818cc9f8fef3fe753.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0699bcd46158669818cc9f8fef3fe753.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
0699bcd46158669818cc9f8fef3fe753.exe
-
Size
134KB
-
MD5
0699bcd46158669818cc9f8fef3fe753
-
SHA1
faa3015fd6893289fda8fc59b5da433264a85844
-
SHA256
31d5ec271c744397f48bfc6af418b450610ac39c718690f350b564d2e5a4994d
-
SHA512
89268d68b9378f55d811394a30805c156b4e259c8d4794507fc9ac195b817bc0b4c5361bc0ae79daf292eed024aa8006ee919a78d3a13ef0e6e28b3ff27f69d5
-
SSDEEP
3072:s1u0Ge/rORlQLMvtWT4bLpVBBY1J4Bhk8OGVnIwQpzjout:sQBe/rOROM1WT4bL7Hz88OGVnI9HoS
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2992-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2992-1-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2688 2992 WerFault.exe 19 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2688 2992 0699bcd46158669818cc9f8fef3fe753.exe 27 PID 2992 wrote to memory of 2688 2992 0699bcd46158669818cc9f8fef3fe753.exe 27 PID 2992 wrote to memory of 2688 2992 0699bcd46158669818cc9f8fef3fe753.exe 27 PID 2992 wrote to memory of 2688 2992 0699bcd46158669818cc9f8fef3fe753.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0699bcd46158669818cc9f8fef3fe753.exe"C:\Users\Admin\AppData\Local\Temp\0699bcd46158669818cc9f8fef3fe753.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 882⤵
- Program crash
PID:2688
-