Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe
Resource
win10v2004-20220901-en
General
-
Target
3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe
-
Size
278KB
-
MD5
4d294bd547e060b471270a061f2790d0
-
SHA1
5630132039b95b2353f65b4794857f7490a59b7c
-
SHA256
3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e
-
SHA512
a226d5379c3804c1ea36c1222f846c303cd512c1cd4bfa0711d90535328049ab847fcdb80c27490e7170917fcf92f73089593c3cb0267bdcab14a9ff48f2a640
-
SSDEEP
3072:QypHXJKOXYE7S860712PktWQLPNTOaEbs77Bk0rEIlNlgkH7aPmu73s+tD+IQOlL:n3JJYuwU2aPdnN3Z7g378yt7
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1996 3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1216 1996 3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe 10 PID 1996 wrote to memory of 1216 1996 3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe"C:\Users\Admin\AppData\Local\Temp\3bb509659900066a5670fda9ac4163094d01288fbcf9615fc0c3ef0788b3378e.exe"2⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1996
-