Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
395s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe
Resource
win10v2004-20221111-en
General
-
Target
9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe
-
Size
200KB
-
MD5
e1eaa3dcbd3df58f80986eea5983487e
-
SHA1
8fc5b30e6f7286596748b006667738b1d6ea7cbf
-
SHA256
9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76
-
SHA512
9375815d8e8e7da1027d95e3a20abba64a284dc6c6b621e9555d93dee098d5717e44c6188396d2d54f5ef5c90c25ed2e8fc26832897c4b5dc61623ac53a83220
-
SSDEEP
3072:Q98ISmD6tDKJlqahog7l4Haqq7V2K0DXk0UrGfasjjwbzM4ZSi3rlYgZfYj:Kr1JsYl46ABvUrEaCjwb444i3rlTZwj
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2480 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe 49 PID 1984 wrote to memory of 2480 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe 49 PID 1984 wrote to memory of 2480 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe 49 PID 1984 wrote to memory of 2480 1984 9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe 49
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe"C:\Users\Admin\AppData\Local\Temp\9da9824b885eeed0d99048df9ecf46562a781272ba628562f3212fe272f7ac76.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
-