Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
484b7586f8b12783849d4d46b95003e7.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
484b7586f8b12783849d4d46b95003e7.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
484b7586f8b12783849d4d46b95003e7.exe
-
Size
23KB
-
MD5
484b7586f8b12783849d4d46b95003e7
-
SHA1
85ab0af7b2afa07016dcfe9725a044180070b8b4
-
SHA256
e1e4ecd94004911ba8e88661ae184be57964555d3e190d4680a22987d0aa61a5
-
SHA512
066335071c8f5de936d7cfc3011ba1c3f81893f045c783775e2d1f95cd057887bbcab76c2558151ac702f4ee30c74e019abdb3ce1129bc006c87310ef179a105
-
SSDEEP
384:j1mV1IHfQxShwZ0zhBQ56vwhvs/Lu+BNkGqcuBl5LPgTkBTH6JxE6ntb+esn01:j1mV1IHfAFZ0dNuKNkGqNGoH6XnN+e40
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2728 2628 WerFault.exe 1 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2728 2628 484b7586f8b12783849d4d46b95003e7.exe 28 PID 2628 wrote to memory of 2728 2628 484b7586f8b12783849d4d46b95003e7.exe 28 PID 2628 wrote to memory of 2728 2628 484b7586f8b12783849d4d46b95003e7.exe 28 PID 2628 wrote to memory of 2728 2628 484b7586f8b12783849d4d46b95003e7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\484b7586f8b12783849d4d46b95003e7.exe"C:\Users\Admin\AppData\Local\Temp\484b7586f8b12783849d4d46b95003e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 882⤵
- Program crash
PID:2728
-