Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22/11/2022, 02:03
Static task
static1
Behavioral task
behavioral1
Sample
b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe
Resource
win10v2004-20220901-en
General
-
Target
b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe
-
Size
518KB
-
MD5
8ec9a1d4ef3508c1bb7c6bd171d10fc6
-
SHA1
83996f364ad6e35a83c89c668d11a18981e40c12
-
SHA256
b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554
-
SHA512
8f8df13561b7cb965cbdb73d25efd7a8c9f0c1ebade07b63d5cb394405789bec11502914aac4f2e3424df8adfe00aad10b0795edd5164f5643626f49e9286c4f
-
SSDEEP
12288:e1EA52NW/i+saC4J36HlRqkKhRzo/wYYlLPt5oKnWq3HDb:wRr/rdC9HlR8hK0lLPt5/Wq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1980 wrote to memory of 884 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 28 PID 1980 wrote to memory of 884 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 28 PID 1980 wrote to memory of 884 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 28 PID 1980 wrote to memory of 884 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 28 PID 1980 wrote to memory of 884 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 28 PID 1980 wrote to memory of 884 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 28 PID 1980 wrote to memory of 884 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 28 PID 1980 wrote to memory of 1728 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 29 PID 1980 wrote to memory of 1728 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 29 PID 1980 wrote to memory of 1728 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 29 PID 1980 wrote to memory of 1728 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 29 PID 1980 wrote to memory of 1728 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 29 PID 1980 wrote to memory of 1728 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 29 PID 1980 wrote to memory of 1728 1980 b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe"C:\Users\Admin\AppData\Local\Temp\b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exestart2⤵PID:884
-
-
C:\Users\Admin\AppData\Local\Temp\b81fcd5be14384b6df156cfa2cd19758496f88f1bbff16227a43a5033fdce554.exewatch2⤵PID:1728
-