Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe
Resource
win10v2004-20220812-en
General
-
Target
3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe
-
Size
505KB
-
MD5
515c6aeb8d4828dfb6cbc3eba741ff14
-
SHA1
4fe1943fc1ebbfd0ba9b851dcf36fa1c1127b3d3
-
SHA256
3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe
-
SHA512
3e4b7ee590da338c16b6154e9e74f52ebd56253a34655aaa5f14ff6a1d30fffd4eec5e193014cad6ca41c2b6ac4cfc6ee88e7c1e4a601d3834952e83f8266608
-
SSDEEP
6144:jvwt+521FTsnpKlZzFTARyIb73/lDGu9iUyQO9B+p0Ssxhp8mXnc0NL0lolfe/Qy:bzmKKlZzFTARyIflKU9D8p8tMATiHGjt
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4868 wrote to memory of 4056 4868 3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe 81 PID 4868 wrote to memory of 4056 4868 3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe 81 PID 4868 wrote to memory of 4056 4868 3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe 81 PID 4868 wrote to memory of 4036 4868 3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe 82 PID 4868 wrote to memory of 4036 4868 3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe 82 PID 4868 wrote to memory of 4036 4868 3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe"C:\Users\Admin\AppData\Local\Temp\3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exestart2⤵PID:4056
-
-
C:\Users\Admin\AppData\Local\Temp\3ae388063dd4f3fdab30ca41e3183ad8bd27e5bd47cee97c4487cc2399e43afe.exewatch2⤵PID:4036
-