Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
236s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe
Resource
win10v2004-20221111-en
General
-
Target
87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe
-
Size
183KB
-
MD5
9b5ab8796b10e2d2d21db83884b6d806
-
SHA1
08bb731aa1a9440cca51c1a4a46d19afb8c69122
-
SHA256
87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74
-
SHA512
eb312f6d672a1604154026f61856eb37d8699f9356ddc0feb2e87504a00b83f262fffe61b5430a7ff16a35686b697aa302f278ddf0f726a1ebbae42afbc6f72e
-
SSDEEP
3072:Sfyj/EPgFHs7aJJD/nLT9IZrmz02F9ZavTLEWTken2TaI/445:SfyAoG7aPndOrTLEWkY0/V5
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1720 set thread context of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28 PID 1720 wrote to memory of 296 1720 87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe"C:\Users\Admin\AppData\Local\Temp\87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe"C:\Users\Admin\AppData\Local\Temp\87de8464e293b44542371a525cd3b51657d2298ad88ecb24e558775a1c259c74.exe"2⤵PID:296
-