Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe
Resource
win10v2004-20220901-en
General
-
Target
d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe
-
Size
1.3MB
-
MD5
c9c4e603d48ad57bc55eaeef6d7533e4
-
SHA1
fe8d56caf75d290fb0d4ec4bc3729f77dbc3cd4f
-
SHA256
d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e
-
SHA512
6677f40b64a38a6892a3c48b11399369793d4247f6eb13f2a280b84b1339205c2f92070f8851b6b8f10f3f72e64057b346c011d14c80206710bd93a01c4f56d0
-
SSDEEP
24576:z7ayPF4Y0obEVsmKB4ZSfoU2+q58eSCIKoBjLyZFT5c+zVnp51kmGaByn:z7au9zKl+/eSCTJTT1Im7Byn
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1996 1884 d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe 27 PID 1884 wrote to memory of 1996 1884 d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe 27 PID 1884 wrote to memory of 1996 1884 d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe 27 PID 1884 wrote to memory of 1996 1884 d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe"C:\Users\Admin\AppData\Local\Temp\d86839e1b54cab99583309678f050b8fe9da3a502cea6764998b5c1e164d642e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\windows\notepad.exe"c:\windows\notepad.exe"2⤵PID:1996
-