Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 18:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
703bbe5d3d6337cea053b5a8b4e3d68c.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
703bbe5d3d6337cea053b5a8b4e3d68c.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
703bbe5d3d6337cea053b5a8b4e3d68c.exe
-
Size
9KB
-
MD5
703bbe5d3d6337cea053b5a8b4e3d68c
-
SHA1
c992080ced5c308f112496bf08d9f732d2ca1fec
-
SHA256
07f16c401cc819d1b546e14327ede9ae91434611e590811f35297d7a443ce682
-
SHA512
0d56661ed551a160eb63816b69f2981a7791f1a16e612636c8d76b73767bb4144de8bbddf0b9f0a522e0e05d3ba97e770e4f25f25db425e9936b5680cdeceb24
-
SSDEEP
192:lAmNtPtK/Pfg2Krzkpwo0ZnLCHt/Kz9f8LqjNHl6KjGo8U2Q:5LVUgTzkOZnLClKz9fXNHlMY
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2996 2912 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2996 2912 703bbe5d3d6337cea053b5a8b4e3d68c.exe 28 PID 2912 wrote to memory of 2996 2912 703bbe5d3d6337cea053b5a8b4e3d68c.exe 28 PID 2912 wrote to memory of 2996 2912 703bbe5d3d6337cea053b5a8b4e3d68c.exe 28 PID 2912 wrote to memory of 2996 2912 703bbe5d3d6337cea053b5a8b4e3d68c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\703bbe5d3d6337cea053b5a8b4e3d68c.exe"C:\Users\Admin\AppData\Local\Temp\703bbe5d3d6337cea053b5a8b4e3d68c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 362⤵
- Program crash
PID:2996
-