Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 06:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88c4811e2a98abb5dd8051899628066d.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
88c4811e2a98abb5dd8051899628066d.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
88c4811e2a98abb5dd8051899628066d.exe
-
Size
44KB
-
MD5
88c4811e2a98abb5dd8051899628066d
-
SHA1
9d89c1d6579827d72b2662d712dcd76c562c9725
-
SHA256
3fd87d314634508458a7e96e3f2b7dbe49e103d05691cb5ec1315c7fda82efd1
-
SHA512
a3e34f88943df8a3f59bd691ce37a188227ab36bd2593142344d1cd66898b62d76de2dad04a5a711d082d68b5f51757c8f12d23e9e44de1d8d97cb723377db4f
-
SSDEEP
384:KSQdQDBs9THDaDyQoF5CU/EP3DriKP6hb/JBou5ZskqSCSMKPcfCoUKi+UdFyC:SeDBAzDZFDKP6JJSuSTL6wQCUdoC
Score
3/10
Malware Config
Signatures
-
Program crash 3 IoCs
pid pid_target Process procid_target 4680 1864 WerFault.exe 84 676 1864 WerFault.exe 84 1044 1864 WerFault.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\88c4811e2a98abb5dd8051899628066d.exe"C:\Users\Admin\AppData\Local\Temp\88c4811e2a98abb5dd8051899628066d.exe"1⤵PID:1864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 2842⤵
- Program crash
PID:4680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 2922⤵
- Program crash
PID:676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 3202⤵
- Program crash
PID:1044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1864 -ip 18641⤵PID:840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1864 -ip 18641⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1864 -ip 18641⤵PID:1672