Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe
Resource
win10v2004-20220812-en
General
-
Target
fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe
-
Size
93KB
-
MD5
82153cab3a3695f0c5503ebc7c274396
-
SHA1
4cb0c76941ee86f2c02db6a2e259fe1736f9ef29
-
SHA256
fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498
-
SHA512
eef67842ca03cc6eb0d3751161e3cb4cf3f96224d1b2637b63e7cec4291fa9db30f45936ebcd44b147aad7ba268fd0871ab1db718c6cf7e3a17432d08711b83c
-
SSDEEP
1536:j9x9JTm7c5AhjR22/G25tjtHbngDXwszub3Vz9xFB:jDTAc5oX/l/GwszubFJP
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 112 fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 112 wrote to memory of 1212 112 fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe 10 PID 112 wrote to memory of 1212 112 fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe 10
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe"C:\Users\Admin\AppData\Local\Temp\fb6051ce24327c7e7839ed94145d2c777a4f383f8beec9e512ed342d3efac498.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:112
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212