Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe
Resource
win10v2004-20221111-en
General
-
Target
74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe
-
Size
126KB
-
MD5
4a09b71a15391a3632a3962397d45968
-
SHA1
94e1be299bbd3cab4f3a83053d63e963a1e56540
-
SHA256
74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4
-
SHA512
a7fa695191ddba38858355baec7b2b78fb96fba3adeb9f0843d4dfc5ab4bfe0a6c0ca9bc2e68393fd9400d8bfd74ab451fcaa40acc22d8cd9ca99eb8e80f6704
-
SSDEEP
3072:7AnGgRwDKxt7ENHeuO2KOSLgk5yGqO3N:0GgvEN+uOeKRqaN
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 848 wrote to memory of 2040 848 74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe 27 PID 848 wrote to memory of 2040 848 74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe 27 PID 848 wrote to memory of 2040 848 74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe 27 PID 848 wrote to memory of 2040 848 74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe"C:\Users\Admin\AppData\Local\Temp\74623d337d8fb5333cd511666c14948cab8f7ebee2eb5341661c556568a466f4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4002⤵PID:2040
-