Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe
Resource
win10v2004-20220812-en
General
-
Target
09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe
-
Size
120KB
-
MD5
9cd8c2c4e20db83a5b45c8ed5cba9fc5
-
SHA1
f66310c20842ec86bdbd95d19f91131a9f7d5d96
-
SHA256
09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a
-
SHA512
6dbf83d37575af79a356d331854f19b4e3b78d021e6b367eecc81fa707f033212c92ba4c0e8eb46300431be47a1c4e745ca56b7f0c1795fe7ad3e1116e9b6129
-
SSDEEP
1536:TUfvXW6Gix6sriD+ULwqNnMUFcGyxITyt40aNFyfRWB07kX4R5NFM9drwEog2fk6:TovWziMC8RnVFcbJUzGR5r0FVJWR
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3992 09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3992 wrote to memory of 4664 3992 09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe 79 PID 3992 wrote to memory of 4664 3992 09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe 79 PID 3992 wrote to memory of 4664 3992 09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe 79 PID 3992 wrote to memory of 4664 3992 09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe 79 PID 3992 wrote to memory of 4664 3992 09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe"C:\Users\Admin\AppData\Local\Temp\09a62dea39018e147b40d2398c5d4d839a8e82101ff76689503aca66c0b52e3a.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:4664
-