Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22/11/2022, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe
Resource
win10v2004-20221111-en
General
-
Target
3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe
-
Size
518KB
-
MD5
e1e9319968eb820832fe453e60e16702
-
SHA1
48b5a93f98f608e442f4e7ad2e64fae37b6b8425
-
SHA256
3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57
-
SHA512
500137ae9b57a6efcf51eda548c8b9f4ba9d2d7e18d0310b95e472e42bf9656b10ff750cd8966d194ff2e3aca0bc066c832d85f4484e5f4aa645912313909143
-
SSDEEP
12288:PmOnS33YbeYcKfWP1OiwYYlLPt5oKnWq3cb:lCYb/lLPt5/W1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2012 wrote to memory of 540 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 26 PID 2012 wrote to memory of 540 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 26 PID 2012 wrote to memory of 540 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 26 PID 2012 wrote to memory of 540 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 26 PID 2012 wrote to memory of 540 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 26 PID 2012 wrote to memory of 540 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 26 PID 2012 wrote to memory of 540 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 26 PID 2012 wrote to memory of 1100 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 27 PID 2012 wrote to memory of 1100 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 27 PID 2012 wrote to memory of 1100 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 27 PID 2012 wrote to memory of 1100 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 27 PID 2012 wrote to memory of 1100 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 27 PID 2012 wrote to memory of 1100 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 27 PID 2012 wrote to memory of 1100 2012 3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe"C:\Users\Admin\AppData\Local\Temp\3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exestart2⤵PID:540
-
-
C:\Users\Admin\AppData\Local\Temp\3bbe7f2dbbb57b5c5df2e423cc602f1f1f0bc4227cc8eb08938251d724becc57.exewatch2⤵PID:1100
-