Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 23:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f55b3dfd3fd7ae6456f553892baa38c.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f55b3dfd3fd7ae6456f553892baa38c.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
1f55b3dfd3fd7ae6456f553892baa38c.exe
-
Size
561KB
-
MD5
1f55b3dfd3fd7ae6456f553892baa38c
-
SHA1
d167e5b485c721305d1154da3c2bce9f084d58fc
-
SHA256
d867479fbde2e6ed425ed010f0ceb11ad553e941366f37f40c753e63ee26767e
-
SHA512
b64f2daef434af4e20a21f7e580749b04663e2336789a8aaf43b83947df5fb005dd4e32720c38d21fa65ea3290e1d00cbd4f0604b7c77a8ace753687b2363e2f
-
SSDEEP
12288:VxNgCDDOxJMD80trLF6PejgTDc//////31l+UC/n4:bOC+xJO1NQoWc//////3D3
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2148 set thread context of 1428 2148 1f55b3dfd3fd7ae6456f553892baa38c.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2292 1428 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1428 2148 1f55b3dfd3fd7ae6456f553892baa38c.exe 28 PID 2148 wrote to memory of 1428 2148 1f55b3dfd3fd7ae6456f553892baa38c.exe 28 PID 2148 wrote to memory of 1428 2148 1f55b3dfd3fd7ae6456f553892baa38c.exe 28 PID 2148 wrote to memory of 1428 2148 1f55b3dfd3fd7ae6456f553892baa38c.exe 28 PID 2148 wrote to memory of 1428 2148 1f55b3dfd3fd7ae6456f553892baa38c.exe 28 PID 2148 wrote to memory of 1428 2148 1f55b3dfd3fd7ae6456f553892baa38c.exe 28 PID 1428 wrote to memory of 2292 1428 1f55b3dfd3fd7ae6456f553892baa38c.exe 29 PID 1428 wrote to memory of 2292 1428 1f55b3dfd3fd7ae6456f553892baa38c.exe 29 PID 1428 wrote to memory of 2292 1428 1f55b3dfd3fd7ae6456f553892baa38c.exe 29 PID 1428 wrote to memory of 2292 1428 1f55b3dfd3fd7ae6456f553892baa38c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f55b3dfd3fd7ae6456f553892baa38c.exe"C:\Users\Admin\AppData\Local\Temp\1f55b3dfd3fd7ae6456f553892baa38c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1f55b3dfd3fd7ae6456f553892baa38c.exeC:\Users\Admin\AppData\Local\Temp\1f55b3dfd3fd7ae6456f553892baa38c.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 1163⤵
- Program crash
PID:2292
-
-