Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
109s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe
Resource
win10v2004-20221111-en
General
-
Target
cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe
-
Size
507KB
-
MD5
6bb371e995738c476c632e9aab5c8fdc
-
SHA1
51e79967d9f355d6bd6d0d170d338a4cea6f8be1
-
SHA256
cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1
-
SHA512
aeae23835189dafd7dc71e06f53d120bf124da79005ae4772383e9a80042c723bad66c7837772836ecd1dcf3b4d94953a545e132f1484a688b03f245b520b5c0
-
SSDEEP
6144:ucsE9dqn/FbHaL88bg+rV5EBkgEsvYf1P9ju86NApD5rCzIcN5fcFkJrUqWUe:FdM/FDxCEBkgE71xu86mD5ez4tqW
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1300 wrote to memory of 1248 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 28 PID 1300 wrote to memory of 1248 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 28 PID 1300 wrote to memory of 1248 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 28 PID 1300 wrote to memory of 1248 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 28 PID 1300 wrote to memory of 1032 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 29 PID 1300 wrote to memory of 1032 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 29 PID 1300 wrote to memory of 1032 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 29 PID 1300 wrote to memory of 1032 1300 cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe"C:\Users\Admin\AppData\Local\Temp\cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exestart2⤵PID:1248
-
-
C:\Users\Admin\AppData\Local\Temp\cc0595d2c44cb4add7c41d428a98b5875e45eb507a8199e35073faad192449d1.exewatch2⤵PID:1032
-