Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 09:54

General

  • Target

    a6c08b16b056f35cf89aead2b4546467d5a287c0108d4aea331dc820fc8df20b.exe

  • Size

    77KB

  • MD5

    d2ad447007401bc827a2fffab1dcc081

  • SHA1

    c31596ad52396c31fa86d4e06de50ce238f7553a

  • SHA256

    a6c08b16b056f35cf89aead2b4546467d5a287c0108d4aea331dc820fc8df20b

  • SHA512

    c7441c84944c0fda1f85ecda91ad864a14bbf3a108ade88c4519dc1391ae36f678081aa1372309490372478e3dd9f8cf2cab668958c2fe13e373ec2b8a93eb6b

  • SSDEEP

    1536:W26Ia7H9O1tULKMa7tnuETGLis/3scovpcYNkRiv6wYaYt/KMxWN:fE9O1gZa7tuSGLii3sxvvaGhYVZxW

Score
1/10

Malware Config

Signatures

  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6c08b16b056f35cf89aead2b4546467d5a287c0108d4aea331dc820fc8df20b.exe
    "C:\Users\Admin\AppData\Local\Temp\a6c08b16b056f35cf89aead2b4546467d5a287c0108d4aea331dc820fc8df20b.exe"
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:1520

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1520-55-0x00000000000C0000-0x00000000000C9000-memory.dmp

      Filesize

      36KB

    • memory/1520-57-0x00000000000C0000-0x00000000000C9000-memory.dmp

      Filesize

      36KB

    • memory/1520-61-0x00000000000C0000-0x00000000000C9000-memory.dmp

      Filesize

      36KB

    • memory/1520-60-0x0000000000890000-0x0000000000898000-memory.dmp

      Filesize

      32KB

    • memory/1520-62-0x00000000000C0000-0x00000000000C9000-memory.dmp

      Filesize

      36KB

    • memory/1812-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

      Filesize

      8KB

    • memory/1812-59-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB