Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe
Resource
win10v2004-20240709-en
General
-
Target
0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe
-
Size
3.0MB
-
MD5
387539254d02064c55935e94f0f56649
-
SHA1
e9967d44ff8a1b1f5d01a133acee35b42f4f4051
-
SHA256
0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101
-
SHA512
7d2050968003e37f1549c966989b6656bf2cc580169d62d765200fe649c898c4b21d5b837dc79061350bb08bd6427551bdded7ff2a58f9f9f7783e4efc659b33
-
SSDEEP
49152:m0l/K0FDru/04QwSrjtujaLI7vrrgzS77VuaqqBO6Gjj7hVrETZmq+Orinkp+cIi:mmdFDrOSSaLIduDqMb3zCgq+O2ngIi
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4560 2160 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 4560 2160 0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe 31 PID 2160 wrote to memory of 4560 2160 0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe 31 PID 2160 wrote to memory of 4560 2160 0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe 31 PID 2160 wrote to memory of 4560 2160 0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe"C:\Users\Admin\AppData\Local\Temp\0479d70c31696169a09d37e34d511b587b1a678563867e41b4881325e9f96101.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 1922⤵
- Program crash
PID:4560
-