Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe
Resource
win10v2004-20240426-en
General
-
Target
0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe
-
Size
125KB
-
MD5
37ae07a5ceb35136d427577af8adaf53
-
SHA1
f743d16750dea860eae4579d9f7c33d52a31334a
-
SHA256
0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e
-
SHA512
50623392a5a89260af263c54fa49d2ada290879f44efaae46903b6280f9684b3b9b2c52881bcb028e69b9fb97d733b9baa34b3d4de37546adedb677450e8e704
-
SSDEEP
3072:my2f6Kt7vWDEvGmY0Sw/T1GVeEzdHVV5719:f2f6C7vsI7hgEGHL571
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1932 2156 0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe 28 PID 2156 wrote to memory of 1932 2156 0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe 28 PID 2156 wrote to memory of 1932 2156 0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe"C:\Users\Admin\AppData\Local\Temp\0b452157350b9c91f8ec01b9260a4b1571063e25ba1fb7e6379dd9504951e11e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2156 -s 5002⤵PID:1932
-