Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
684b0c2a41297d6720c2e1c9a8fca11a.exe
Resource
win7-20231215-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
684b0c2a41297d6720c2e1c9a8fca11a.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
684b0c2a41297d6720c2e1c9a8fca11a.exe
-
Size
1KB
-
MD5
684b0c2a41297d6720c2e1c9a8fca11a
-
SHA1
7702345fbd5ee061bc43a6f5ece0998e42dc1803
-
SHA256
bb044ea23022a724659904f607bacedb47d9458b492d4086d506a86c9d21d3ec
-
SHA512
35530999e4b9e075579ea0e5835343ee2b6bdac4eb7a64725a50c2a890bde90fac1feb54cc49101ee7c940a1d58138b1582bfdce3f7c2cc4b462b509ebe8890b
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4576 3916 WerFault.exe 83 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3916 684b0c2a41297d6720c2e1c9a8fca11a.exe -
Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3916 wrote to memory of 3520 3916 684b0c2a41297d6720c2e1c9a8fca11a.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\684b0c2a41297d6720c2e1c9a8fca11a.exe"C:\Users\Admin\AppData\Local\Temp\684b0c2a41297d6720c2e1c9a8fca11a.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 2643⤵
- Program crash
PID:4576
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3916 -ip 39161⤵PID:1304