Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 00:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95c04992bf14769fbd1b7b0ada9b9e87.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
95c04992bf14769fbd1b7b0ada9b9e87.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
95c04992bf14769fbd1b7b0ada9b9e87.exe
-
Size
54KB
-
MD5
95c04992bf14769fbd1b7b0ada9b9e87
-
SHA1
e4453a0ffd12e63d8b9c27dcbbda07569407f86e
-
SHA256
0691fb6c43432dcf56ecaab8a5bfc40890fcc43dffada38e6719d09ae9b94a8b
-
SHA512
dddfecca5a62aa91aeb0ac749ce42cd70491786c35fd691af61ea4ad3e9a077f3184080c7b58ca23b98cd984d777b0c75ac8fbb14e281882192e71cf74823b6c
-
SSDEEP
1536:CCRGM1XhxZYqxvew8l/7Eqi7pT2nrQMi:CsGM5egqJIZpT2nsJ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2956 2804 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2956 2804 95c04992bf14769fbd1b7b0ada9b9e87.exe 28 PID 2804 wrote to memory of 2956 2804 95c04992bf14769fbd1b7b0ada9b9e87.exe 28 PID 2804 wrote to memory of 2956 2804 95c04992bf14769fbd1b7b0ada9b9e87.exe 28 PID 2804 wrote to memory of 2956 2804 95c04992bf14769fbd1b7b0ada9b9e87.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\95c04992bf14769fbd1b7b0ada9b9e87.exe"C:\Users\Admin\AppData\Local\Temp\95c04992bf14769fbd1b7b0ada9b9e87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1242⤵
- Program crash
PID:2956
-