Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 11:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cb3a833738bb7d8e7d4793de4e486e3.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3cb3a833738bb7d8e7d4793de4e486e3.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
3cb3a833738bb7d8e7d4793de4e486e3.exe
-
Size
57KB
-
MD5
3cb3a833738bb7d8e7d4793de4e486e3
-
SHA1
b50d00f8f1f507b2098d3da163fdb765782e1faa
-
SHA256
6ab01a8745cde02e6a5211089094410dfcf60035cdbd96eab2cedbc164e54c42
-
SHA512
04ae97cbe901a9c34a529b5b7ed65c846234895a34f6ada1e14eab5d1b69e6507b660e804f0f004de59a015259d83d612942088dae24c7379f8609cd83e1d878
-
SSDEEP
768:HdSsNx2tnxkztM0BdDMdpd5P9EUulCNBMGvmAIWo+LUbS0cq/9uJjjgyTE6i+Tkd:5x2tn85MfSUiCzMOLU+Vjsybg1
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2676 1220 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1220 wrote to memory of 2676 1220 3cb3a833738bb7d8e7d4793de4e486e3.exe 28 PID 1220 wrote to memory of 2676 1220 3cb3a833738bb7d8e7d4793de4e486e3.exe 28 PID 1220 wrote to memory of 2676 1220 3cb3a833738bb7d8e7d4793de4e486e3.exe 28 PID 1220 wrote to memory of 2676 1220 3cb3a833738bb7d8e7d4793de4e486e3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cb3a833738bb7d8e7d4793de4e486e3.exe"C:\Users\Admin\AppData\Local\Temp\3cb3a833738bb7d8e7d4793de4e486e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 882⤵
- Program crash
PID:2676
-