Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 20:21
Behavioral task
behavioral1
Sample
65f2db5e3b1106f4199e97d27523d014.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
65f2db5e3b1106f4199e97d27523d014.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
65f2db5e3b1106f4199e97d27523d014.exe
-
Size
308KB
-
MD5
65f2db5e3b1106f4199e97d27523d014
-
SHA1
ceab4507d7f3928ae6a16e62e7687ec51e1e7b6b
-
SHA256
7fb42aa046e609fea1e2619140984a2f5b2afd6204505e85608dc9338d20ac3b
-
SHA512
30c662074936490fea111e86f85676e39297063d10dc21a84f13683ffdfd2161a02443b8f5ce25ca480b530b73d5cbc2b7e780eb48b9a3c99f37223bee202141
-
SSDEEP
6144:f60yLW4Z/OiwEdzFduwv/QVXbRfzEesSksOW7vQ6gS5IzVRD3OfoS:f60ya4MEdKNf/sDsOW7vQXS2zVRD3OfZ
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral1/memory/2396-2-0x0000000000400000-0x00000000004D7000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2332 2396 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2332 2396 65f2db5e3b1106f4199e97d27523d014.exe 28 PID 2396 wrote to memory of 2332 2396 65f2db5e3b1106f4199e97d27523d014.exe 28 PID 2396 wrote to memory of 2332 2396 65f2db5e3b1106f4199e97d27523d014.exe 28 PID 2396 wrote to memory of 2332 2396 65f2db5e3b1106f4199e97d27523d014.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\65f2db5e3b1106f4199e97d27523d014.exe"C:\Users\Admin\AppData\Local\Temp\65f2db5e3b1106f4199e97d27523d014.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1802⤵
- Program crash
PID:2332
-