Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1e0f578f12f34122ab5edd0f8ad0516.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1e0f578f12f34122ab5edd0f8ad0516.exe
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
e1e0f578f12f34122ab5edd0f8ad0516.exe
-
Size
325KB
-
MD5
e1e0f578f12f34122ab5edd0f8ad0516
-
SHA1
d37efb900970a4707c2c051fcff6fc96bc354958
-
SHA256
dd23b26b9745b8b2f4b99b75fad73036ebccf6620d9725626a3dc7b746f06e83
-
SHA512
0dcf3a985b95bdf1520c32ba8cad6f593910995df4d801c3ec277eae253363319cb49a6712c92e1e3a30f9726beb1794acab591b9e272c6f2f23d9c0b455456e
-
SSDEEP
6144:B8nMF2idZecnl20lHRxp3gzI8qQpuCwRtzGazUVdUXxbNtpXS5cuFjWOE4c:WsF3Z4mxxSCQ4/GaadUh7xAddc
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1896 2812 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2812 wrote to memory of 1896 2812 e1e0f578f12f34122ab5edd0f8ad0516.exe 28 PID 2812 wrote to memory of 1896 2812 e1e0f578f12f34122ab5edd0f8ad0516.exe 28 PID 2812 wrote to memory of 1896 2812 e1e0f578f12f34122ab5edd0f8ad0516.exe 28 PID 2812 wrote to memory of 1896 2812 e1e0f578f12f34122ab5edd0f8ad0516.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1e0f578f12f34122ab5edd0f8ad0516.exe"C:\Users\Admin\AppData\Local\Temp\e1e0f578f12f34122ab5edd0f8ad0516.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1562⤵
- Program crash
PID:1896
-