Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09ee235789d1cf29fcbfda8aa0b7eaa6.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
09ee235789d1cf29fcbfda8aa0b7eaa6.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
09ee235789d1cf29fcbfda8aa0b7eaa6.exe
-
Size
136KB
-
MD5
09ee235789d1cf29fcbfda8aa0b7eaa6
-
SHA1
a16f4160ad4360d53b7fd2a3424bad37684d3da9
-
SHA256
4192c4669c74c5e4be3d53564e95128723a23d91517f902030ab0b11b6b393d2
-
SHA512
0a8b299e881085176353b3eabc940cd0af126c6d8e89103fd86b43c2f49fc08ff9069c6fb72addd8dfccb3adcf8f55dc5ea12071d9d384acebf644a44a5c557b
-
SSDEEP
3072:3tVzCh/Myq93qi8w0win//PQxBGp0N7f+Puc6ku+HuUx:WYai8w5e//P4oTTu2uo
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2184 2228 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2228 09ee235789d1cf29fcbfda8aa0b7eaa6.exe 2228 09ee235789d1cf29fcbfda8aa0b7eaa6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2184 2228 09ee235789d1cf29fcbfda8aa0b7eaa6.exe 28 PID 2228 wrote to memory of 2184 2228 09ee235789d1cf29fcbfda8aa0b7eaa6.exe 28 PID 2228 wrote to memory of 2184 2228 09ee235789d1cf29fcbfda8aa0b7eaa6.exe 28 PID 2228 wrote to memory of 2184 2228 09ee235789d1cf29fcbfda8aa0b7eaa6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\09ee235789d1cf29fcbfda8aa0b7eaa6.exe"C:\Users\Admin\AppData\Local\Temp\09ee235789d1cf29fcbfda8aa0b7eaa6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1602⤵
- Program crash
PID:2184
-