Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe
Resource
win10-20240404-en
General
-
Target
d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe
-
Size
4.3MB
-
MD5
11863412761ab6f0dadd70d838ac3989
-
SHA1
5724e78c916f83766cfc219c42beb4948ff3315d
-
SHA256
d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91
-
SHA512
1603837c5eea79c4785d1580fa29aaf06ae8ae05377e2ad271ad457675d40315350ee245e9039a241d9def0c068c48159a76fc7fdf7bd154165881ddd900c6e3
-
SSDEEP
98304:SYVezkr9ZS9RKzQwEk5fhS2drRroeSLo96Dv45rrvUW9AY:S2ezkr9ZSDKzQwEk5fptUeAQpz5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1228 1704 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1228 1704 d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe 28 PID 1704 wrote to memory of 1228 1704 d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe 28 PID 1704 wrote to memory of 1228 1704 d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe 28 PID 1704 wrote to memory of 1228 1704 d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe"C:\Users\Admin\AppData\Local\Temp\d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 5522⤵
- Program crash
PID:1228
-