Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2884aa0007d1e06216565dcd15466970.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2884aa0007d1e06216565dcd15466970.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2884aa0007d1e06216565dcd15466970.exe
-
Size
112KB
-
MD5
2884aa0007d1e06216565dcd15466970
-
SHA1
848a311901b797782a23f8c6df766bf35827b331
-
SHA256
4b047eee9ee680841f286716409235872693ae3a5ca54acfb3280ef3307ab08c
-
SHA512
8da4222fed58609a29fc4ad4da30c2c1f61d23e1b68ecbdb1a0744f6b4cb9a86520b4e53f0daa48cb199b5013819e6db147ed46d255525f633ae3df97c4899d1
-
SSDEEP
1536:r2JW6/4BEzByeEoHhA8Lh7I0FlJlmBjs+WymZvVoejRGjOisGuXJ2mR2HV:ro1/nzUjcTaOlJUXWy0vaSbBXJ2m
Score
3/10
Malware Config
Signatures
-
Program crash 3 IoCs
pid pid_target Process procid_target 4412 1640 WerFault.exe 87 3988 1640 WerFault.exe 87 1760 1640 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1640 wrote to memory of 4412 1640 2884aa0007d1e06216565dcd15466970.exe 95 PID 1640 wrote to memory of 4412 1640 2884aa0007d1e06216565dcd15466970.exe 95 PID 1640 wrote to memory of 4412 1640 2884aa0007d1e06216565dcd15466970.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2884aa0007d1e06216565dcd15466970.exe"C:\Users\Admin\AppData\Local\Temp\2884aa0007d1e06216565dcd15466970.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2242⤵
- Program crash
PID:4412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2202⤵
- Program crash
PID:3988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2242⤵
- Program crash
PID:1760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1640 -ip 16401⤵PID:732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1640 -ip 16401⤵PID:432