Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
124075847d65af7fa35a724e44d67922.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
124075847d65af7fa35a724e44d67922.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
124075847d65af7fa35a724e44d67922.exe
-
Size
115KB
-
MD5
124075847d65af7fa35a724e44d67922
-
SHA1
23cfca05bbd06e28663d9d060e5998b31bce7499
-
SHA256
30e875fbfb86e1f0b0cb560f10ec21aad227820e150cb3d2654045a5105e9d0a
-
SHA512
c8f9d77b92a90b6c207d7c5d7c5a0f9c56dd013c2a14b1c074179bf4afe77136d08889b9353b49fafd877e3a46bea467b4347fd510ce5112167258f02ba2e099
-
SSDEEP
1536:UkoAzrk0MkJaG3Tmi8eCWWAu4+y268gtZYL8637EZ3c:JRzrnMZG318eCWlkyB86ZY464O
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2804 2724 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2804 2724 124075847d65af7fa35a724e44d67922.exe 27 PID 2724 wrote to memory of 2804 2724 124075847d65af7fa35a724e44d67922.exe 27 PID 2724 wrote to memory of 2804 2724 124075847d65af7fa35a724e44d67922.exe 27 PID 2724 wrote to memory of 2804 2724 124075847d65af7fa35a724e44d67922.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\124075847d65af7fa35a724e44d67922.exe"C:\Users\Admin\AppData\Local\Temp\124075847d65af7fa35a724e44d67922.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 1322⤵
- Program crash
PID:2804
-