Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 12:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d61303088b2cabe68abdca758c8b32e3.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
d61303088b2cabe68abdca758c8b32e3.exe
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
d61303088b2cabe68abdca758c8b32e3.exe
-
Size
115KB
-
MD5
d61303088b2cabe68abdca758c8b32e3
-
SHA1
5edbccf5d4f465566a1fcbff6a1884d085ba236a
-
SHA256
838436bcd1bbfa4cd59cc1b16a58dcc9a824ba6f83e791301014b1e04480aa95
-
SHA512
30c58018deecfc38a919b6d8ab7294b26552551ff4a3228f27e006a9906295da891fbc832deb16d278cbdab8b39679abe9c26ccd9cebe6b1723af1df174eaa84
-
SSDEEP
3072:TOeuGU4MGinYNwT1cPCC/nU+NeA5H28ndyQUTXwO:TOHVPYNs+6cU+IA5H22dmH
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2840 1404 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1404 wrote to memory of 2840 1404 d61303088b2cabe68abdca758c8b32e3.exe 28 PID 1404 wrote to memory of 2840 1404 d61303088b2cabe68abdca758c8b32e3.exe 28 PID 1404 wrote to memory of 2840 1404 d61303088b2cabe68abdca758c8b32e3.exe 28 PID 1404 wrote to memory of 2840 1404 d61303088b2cabe68abdca758c8b32e3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d61303088b2cabe68abdca758c8b32e3.exe"C:\Users\Admin\AppData\Local\Temp\d61303088b2cabe68abdca758c8b32e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 362⤵
- Program crash
PID:2840
-