Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe
Resource
win10v2004-20220812-en
General
-
Target
bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe
-
Size
507KB
-
MD5
56b69870745ee39d50e6afd1db8661c6
-
SHA1
74fe9fb51dd247621c6776ec0f7798b3a28d8532
-
SHA256
bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7
-
SHA512
89bab99130eca39ea129fd6f9baf8f7bcbad325416c84cc4a2a61767485620149dc35137e7e1cce18d4498aa2a529b243336301eaf8f0966555c46b0d8a4cdb5
-
SSDEEP
6144:KINa9uHeh5TD91UWt3NKNlmxQZNpnc8lr2GmD0hXvCzIcN5fcFkJr1kJWjE:V+h592k38e+yurm2az40mW
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1976 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 28 PID 1716 wrote to memory of 1976 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 28 PID 1716 wrote to memory of 1976 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 28 PID 1716 wrote to memory of 1976 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 28 PID 1716 wrote to memory of 1504 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 29 PID 1716 wrote to memory of 1504 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 29 PID 1716 wrote to memory of 1504 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 29 PID 1716 wrote to memory of 1504 1716 bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe"C:\Users\Admin\AppData\Local\Temp\bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exestart2⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\bcc6630d0cf034c6df6daea401aea183b2d1ff2f961eeaec9040d03b9d080ec7.exewatch2⤵PID:1504
-