Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/01/2024, 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ff6d0e450ecd38bd82e6da4e3a6305d.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6ff6d0e450ecd38bd82e6da4e3a6305d.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
6ff6d0e450ecd38bd82e6da4e3a6305d.exe
-
Size
451KB
-
MD5
6ff6d0e450ecd38bd82e6da4e3a6305d
-
SHA1
a602002cfb55a735d832b36aa9b5082589ed5f77
-
SHA256
ee06cd80d542a3c47d88ad7100143d2d882f4eb70353f3ce619653bab8631557
-
SHA512
db3c02f40b8c1265e85230122d7783865df6bd847baab2f0b4853a19b2332117c7b67acb3dfff08433257467697113850930d2fe98614193de6137624d292b83
-
SSDEEP
6144:g7+A/EjAYBe8v5oS7H6NGHpj1XxDVDwPZA/dBNOdTbDL+XIAv8ZzJIGpFmBv8ft+:m+CEBf68j1X/kBKuOp8ZzJjFFXoLlh
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2744 2996 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2744 2996 6ff6d0e450ecd38bd82e6da4e3a6305d.exe 28 PID 2996 wrote to memory of 2744 2996 6ff6d0e450ecd38bd82e6da4e3a6305d.exe 28 PID 2996 wrote to memory of 2744 2996 6ff6d0e450ecd38bd82e6da4e3a6305d.exe 28 PID 2996 wrote to memory of 2744 2996 6ff6d0e450ecd38bd82e6da4e3a6305d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ff6d0e450ecd38bd82e6da4e3a6305d.exe"C:\Users\Admin\AppData\Local\Temp\6ff6d0e450ecd38bd82e6da4e3a6305d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1282⤵
- Program crash
PID:2744
-