Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 13:31
Behavioral task
behavioral1
Sample
csrss.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
csrss.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
ntldll.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
ntldll.dll
Resource
win10v2004-20220812-en
General
-
Target
csrss.exe
-
Size
392KB
-
MD5
64f0afeb5835d985a34b5a69f3673d49
-
SHA1
5c4ded38e009ee1cc442aedc093affb394cea806
-
SHA256
6fc132918b9ba4fc55d19ca4dad12f20745eea4b9fc85cf5e1abfdc65e1db4fe
-
SHA512
e5f2229e94f1696de9e7f2b08e01487eefecc2ae426417cfe289457532acf4ce1e9ee6082c7d886e4aa6a6fb37370791ea815dcd43e11a44afc0412265197e70
-
SSDEEP
6144:8gAK4iyFJa5Bk/LtzAJg3pKOEfsMYE3XRU/3EoD2gUhZ5BlZrMol:GKByFJa/k/ZZ3pZE193XCSgUPjc+
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3692-132-0x0000000000D00000-0x00000000026B4000-memory.dmp upx behavioral2/memory/3692-133-0x0000000000D00000-0x00000000026B4000-memory.dmp upx behavioral2/memory/3692-134-0x0000000000D00000-0x00000000026B4000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\placavga.ico csrss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3692 csrss.exe