Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e05567d8283ab2f8e6abe549c0fa74b9.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e05567d8283ab2f8e6abe549c0fa74b9.exe
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
e05567d8283ab2f8e6abe549c0fa74b9.exe
-
Size
430KB
-
MD5
e05567d8283ab2f8e6abe549c0fa74b9
-
SHA1
22bed3ffdc109f3c9333f5ab0d013e17d6318923
-
SHA256
9c51c419e7d0f0ebade31495c74cd4e5bb0f9b8000c9dc30ec7b4972fe97a26e
-
SHA512
10b5a3316db6f9e1cecd0fd3a2000e3af8b07afee6cb45fb889fc43a8d19689827b2741fa6a69e1cb68213aa36ba0bfe541d1eb43aa703b32abb4c3ae03dffb0
-
SSDEEP
6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2796 2840 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2796 2840 e05567d8283ab2f8e6abe549c0fa74b9.exe 28 PID 2840 wrote to memory of 2796 2840 e05567d8283ab2f8e6abe549c0fa74b9.exe 28 PID 2840 wrote to memory of 2796 2840 e05567d8283ab2f8e6abe549c0fa74b9.exe 28 PID 2840 wrote to memory of 2796 2840 e05567d8283ab2f8e6abe549c0fa74b9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e05567d8283ab2f8e6abe549c0fa74b9.exe"C:\Users\Admin\AppData\Local\Temp\e05567d8283ab2f8e6abe549c0fa74b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1162⤵
- Program crash
PID:2796
-