Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 07:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d5563d1ee77b0413861b6add770b960.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d5563d1ee77b0413861b6add770b960.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2d5563d1ee77b0413861b6add770b960.exe
-
Size
43KB
-
MD5
2d5563d1ee77b0413861b6add770b960
-
SHA1
42262f499463bbd6a842db842cd2c6799a8ea3e9
-
SHA256
09df1cb53576320f811905d4cd5b93d9d13d4899a7742c9929bcb3cbaef66688
-
SHA512
c3a356bb6445b0e8eec08be344042cf1aa6dccec31f9e6cea87e558eca3c96728a0ecd65d57f928a6340210db1baf81785562a519560b19bb86a865c53995324
-
SSDEEP
768:8GOM7v3m1AtIeGKPxlD2zidwW1xDR49D1CxaCsQuVcRRYUSUtkqAPcr+Ya3dxr22:8GOMr2GPGgG+TrDR49D1CxaqKqAErP+L
Score
3/10
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 4476 2288 WerFault.exe 89 2060 2288 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2288 wrote to memory of 4476 2288 2d5563d1ee77b0413861b6add770b960.exe 97 PID 2288 wrote to memory of 4476 2288 2d5563d1ee77b0413861b6add770b960.exe 97 PID 2288 wrote to memory of 4476 2288 2d5563d1ee77b0413861b6add770b960.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d5563d1ee77b0413861b6add770b960.exe"C:\Users\Admin\AppData\Local\Temp\2d5563d1ee77b0413861b6add770b960.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2282⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2282⤵
- Program crash
PID:2060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2288 -ip 22881⤵PID:2632