Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a9b11421ba121e52cf3d40e59ccb330.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a9b11421ba121e52cf3d40e59ccb330.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
9a9b11421ba121e52cf3d40e59ccb330.exe
-
Size
89KB
-
MD5
9a9b11421ba121e52cf3d40e59ccb330
-
SHA1
2cfcf27f8a9bfbb138df8495d666240396a5f74a
-
SHA256
a21e1d563a5208c10394779abe962d8c620b9234ea00f0e11edbfa864462ae5e
-
SHA512
8bece51abc3e3985ce11950919d3328e780b0e4f74fa6da6f65b07b34624146d7b4f089a5f565123f48d983f3dfefb2cf4682b835b2322da5a4dcac7f931ed63
-
SSDEEP
1536:i1yhGafPgBQFRwoMbJT9AFWk+9EIegoY9eVDxxkgbU/j3:iwGafAoMbJTG/8EDgUVckU/j
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 856 1796 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1796 wrote to memory of 856 1796 9a9b11421ba121e52cf3d40e59ccb330.exe 28 PID 1796 wrote to memory of 856 1796 9a9b11421ba121e52cf3d40e59ccb330.exe 28 PID 1796 wrote to memory of 856 1796 9a9b11421ba121e52cf3d40e59ccb330.exe 28 PID 1796 wrote to memory of 856 1796 9a9b11421ba121e52cf3d40e59ccb330.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a9b11421ba121e52cf3d40e59ccb330.exe"C:\Users\Admin\AppData\Local\Temp\9a9b11421ba121e52cf3d40e59ccb330.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 922⤵
- Program crash
PID:856
-