Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 08:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ebaf6d1f832270fcbafb6b166875345.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ebaf6d1f832270fcbafb6b166875345.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
8ebaf6d1f832270fcbafb6b166875345.exe
-
Size
116KB
-
MD5
8ebaf6d1f832270fcbafb6b166875345
-
SHA1
ed23f154642c22a69744b17e2b92a9375d83866f
-
SHA256
10e3fb344738b40ce4645839595f8b33694e1e94ccc8bee4ca37cf95df633256
-
SHA512
120e8fbd767f285defd9d22b77c8b14bbe98b1217a9fbbc6a81a53f566c93a07f6a8dfa0b083b81bb7848c9497d2a45b04b60b55edbb3c53333c2590be52bfca
-
SSDEEP
1536:AYFLifZPRHOCqPtH3Vd3DgFIBtEHetBpytvs5B6/VQZHywPmbZfKB36Qt+P4GNuU:AOmRAxketEHlkf6/VQ7N6QtXGNz3N
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2004 1648 WerFault.exe 16 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2004 1648 8ebaf6d1f832270fcbafb6b166875345.exe 28 PID 1648 wrote to memory of 2004 1648 8ebaf6d1f832270fcbafb6b166875345.exe 28 PID 1648 wrote to memory of 2004 1648 8ebaf6d1f832270fcbafb6b166875345.exe 28 PID 1648 wrote to memory of 2004 1648 8ebaf6d1f832270fcbafb6b166875345.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ebaf6d1f832270fcbafb6b166875345.exe"C:\Users\Admin\AppData\Local\Temp\8ebaf6d1f832270fcbafb6b166875345.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 362⤵
- Program crash
PID:2004
-