Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2379c0080d8def684c094ccf5cb0e649.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2379c0080d8def684c094ccf5cb0e649.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
2379c0080d8def684c094ccf5cb0e649.exe
-
Size
75KB
-
MD5
2379c0080d8def684c094ccf5cb0e649
-
SHA1
f825744d9278396416a3b4b267d5a0826ce6107e
-
SHA256
0a244f576e7241de6d3145eda0e94375be7919479826316ca0943a71e9e9e371
-
SHA512
a1594f0825d9e3232fbe7e2cb588db22259d7c51ef74a3f68fb0984b4704ea15ce0fa3bb4a3d0611a6b8ebd0d72d121fb8c865f43b6fdcb694e7a8421c008d76
-
SSDEEP
1536:9OY499DAG7T7P8e6sL+AmWzNzRPOWLK6AoTtBaBCO8lrJYCRLC:954Dn7vv62mWRzgcAoTtBzRrYCRLC
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 2316 2264 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2316 2264 2379c0080d8def684c094ccf5cb0e649.exe 16 PID 2264 wrote to memory of 2316 2264 2379c0080d8def684c094ccf5cb0e649.exe 16 PID 2264 wrote to memory of 2316 2264 2379c0080d8def684c094ccf5cb0e649.exe 16 PID 2264 wrote to memory of 2316 2264 2379c0080d8def684c094ccf5cb0e649.exe 16
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 921⤵
- Program crash
PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2379c0080d8def684c094ccf5cb0e649.exe"C:\Users\Admin\AppData\Local\Temp\2379c0080d8def684c094ccf5cb0e649.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264