Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    96s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    09/07/2020, 13:46

General

  • Target

    7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe

  • Size

    5KB

  • MD5

    f9d87efa9e7c1dc50fbc643eb76bb500

  • SHA1

    bebf1e4b4824c9d87bcc846cea9352ecb632bc25

  • SHA256

    7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e

  • SHA512

    bbab0263027a4e8495c182b27b869ddbcadf76945d2f0bd8f43fe776bda211b21fda6a3318401825cc1fce6a234adb3c4b0b532a59acfbabd253b7501983ef2d

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe
    "C:\Users\Admin\AppData\Local\Temp\7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 816
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3352-1-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/3352-2-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/3352-8-0x0000000002F60000-0x0000000002F61000-memory.dmp

    Filesize

    4KB

  • memory/3352-9-0x0000000002F60000-0x0000000002F61000-memory.dmp

    Filesize

    4KB

  • memory/3352-10-0x0000000002F60000-0x0000000002F61000-memory.dmp

    Filesize

    4KB