Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22712b3b72d6f8c09a9fadb0def88786.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
22712b3b72d6f8c09a9fadb0def88786.exe
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
22712b3b72d6f8c09a9fadb0def88786.exe
-
Size
76KB
-
MD5
22712b3b72d6f8c09a9fadb0def88786
-
SHA1
1c647b08d09a82cbf5a23ed73457dc098aa913d1
-
SHA256
39aa3e5f53375ab67cea5cd5905cbde9639cb75b75cf0d601a0e88d6e00076c7
-
SHA512
9deba53f951eddd29b0189fa683e0526d6c8c4479df31658925f8b76eb3a1e909382dd6db699b257b14661f1f6452ef8b8229d3e625a6dd75599cfa969b4cab1
-
SSDEEP
1536:7HycqGWLsFwu28M+34EtlbhG3Lw225y5NfkZC3zGwj+pjVrs2ryrd1vUQuq6:7HyLGau2LnEtlbhG022In8ZCDGwyHs2N
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1984 2028 WerFault.exe 1 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1984 2028 22712b3b72d6f8c09a9fadb0def88786.exe 16 PID 2028 wrote to memory of 1984 2028 22712b3b72d6f8c09a9fadb0def88786.exe 16 PID 2028 wrote to memory of 1984 2028 22712b3b72d6f8c09a9fadb0def88786.exe 16 PID 2028 wrote to memory of 1984 2028 22712b3b72d6f8c09a9fadb0def88786.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\22712b3b72d6f8c09a9fadb0def88786.exe"C:\Users\Admin\AppData\Local\Temp\22712b3b72d6f8c09a9fadb0def88786.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 362⤵
- Program crash
PID:1984
-