Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4716ade4eb2b3a0adf81fd7ffe8ec80a.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4716ade4eb2b3a0adf81fd7ffe8ec80a.exe
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
4716ade4eb2b3a0adf81fd7ffe8ec80a.exe
-
Size
78KB
-
MD5
4716ade4eb2b3a0adf81fd7ffe8ec80a
-
SHA1
defe16b381d4c2be9fcd894b0c4441cca29c3cc2
-
SHA256
c3a9984b023df32ec38cfdd939d50f1fccf680fe2d748a0ec0ef2802a6ea8613
-
SHA512
a351dca13044a31b5ea49c627f1c84e6ff520b62e9576803d0f1d004a3276d58e963a0b7605af7362035a3825feab1dfd03dcfcb4fc6b6ae45c02067b07bd79b
-
SSDEEP
1536:ZgEQtcpPyOUhU/CSRZE3h4YB7vGEUKZuXRpFLxyuCE00lE0T:OEQtoyOcKZEfB6/KZuXNV0i5T
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 1780 2180 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1780 2180 4716ade4eb2b3a0adf81fd7ffe8ec80a.exe 14 PID 2180 wrote to memory of 1780 2180 4716ade4eb2b3a0adf81fd7ffe8ec80a.exe 14 PID 2180 wrote to memory of 1780 2180 4716ade4eb2b3a0adf81fd7ffe8ec80a.exe 14 PID 2180 wrote to memory of 1780 2180 4716ade4eb2b3a0adf81fd7ffe8ec80a.exe 14
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 881⤵
- Program crash
PID:1780
-
C:\Users\Admin\AppData\Local\Temp\4716ade4eb2b3a0adf81fd7ffe8ec80a.exe"C:\Users\Admin\AppData\Local\Temp\4716ade4eb2b3a0adf81fd7ffe8ec80a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180