Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe
Resource
win10v2004-20221111-en
General
-
Target
876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe
-
Size
522KB
-
MD5
90a379d925b1041a3d8dbdb244a15fd0
-
SHA1
077ae249634b968bde4ba7664769a3e3f78f8ba2
-
SHA256
876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce
-
SHA512
b1e0e195da90813b3e1182da26b06aabce8765e2564abedda3b15dd3fec888efa2d5ac325b8157c15582485f7a459f88e2eaeb4b6645fafc30bcdeacc4f109f2
-
SSDEEP
12288:fUxBf2/Mcmqa3mheG+20eAgy18xQqpx8O5V:MxBehha3ip+200atqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1460 wrote to memory of 928 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 28 PID 1460 wrote to memory of 928 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 28 PID 1460 wrote to memory of 928 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 28 PID 1460 wrote to memory of 928 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 28 PID 1460 wrote to memory of 928 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 28 PID 1460 wrote to memory of 928 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 28 PID 1460 wrote to memory of 928 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 28 PID 1460 wrote to memory of 316 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 29 PID 1460 wrote to memory of 316 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 29 PID 1460 wrote to memory of 316 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 29 PID 1460 wrote to memory of 316 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 29 PID 1460 wrote to memory of 316 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 29 PID 1460 wrote to memory of 316 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 29 PID 1460 wrote to memory of 316 1460 876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe"C:\Users\Admin\AppData\Local\Temp\876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exestart2⤵PID:928
-
-
C:\Users\Admin\AppData\Local\Temp\876f0b1f1614ea4f756e808ae0678c70817146b4d079d0985dd19d7a9fd827ce.exewatch2⤵PID:316
-