Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 16:11
Static task
static1
Behavioral task
behavioral1
Sample
4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe
Resource
win10v2004-20220901-en
General
-
Target
4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe
-
Size
493KB
-
MD5
35754913833925ab186d78b3fe216332
-
SHA1
e6e250d61ffafc1866e3faace7e868e7a03166c4
-
SHA256
4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63
-
SHA512
b801851464cebdb03e019375b7ca839c95bd9de49c3bc7077d2f41dde442b7e3ec43722f5002822519414d2366485cfa0b1eee823065fb5196653435125b3c64
-
SSDEEP
6144:fXBRcJdNpWVW+Z/GoQRejZib+e6qkhgRT0DyjJMr8wpBsllY408l/c+BosxMkt0+:fzVe5eib+K4HM7FLLxGLUP46r
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1428 1724 4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe 81 PID 1724 wrote to memory of 1428 1724 4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe 81 PID 1724 wrote to memory of 1428 1724 4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe 81 PID 1724 wrote to memory of 464 1724 4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe 82 PID 1724 wrote to memory of 464 1724 4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe 82 PID 1724 wrote to memory of 464 1724 4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe"C:\Users\Admin\AppData\Local\Temp\4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exestart2⤵PID:1428
-
-
C:\Users\Admin\AppData\Local\Temp\4523eea67a6b5002037cdd4f28898bb4bec1074d3aa54222bb63f286fb7abd63.exewatch2⤵PID:464
-