Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 09:59
Static task
static1
Behavioral task
behavioral1
Sample
5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe
Resource
win10v2004-20220812-en
General
-
Target
5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe
-
Size
130KB
-
MD5
96e7ca742a485a785f6db57433df0204
-
SHA1
66f823af16a87d937d4ee99a117865a7b67fd49c
-
SHA256
5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752
-
SHA512
cadc71a37892a85a8905f5cb8840c7933fe630b0fe89bdbf48bdd1b27a7295a7c383ebc366944a12a969120d55b6cafc1148cb3c0a2ebc20c3356465cb43d717
-
SSDEEP
3072:TTG1QgDWCtFPc/+gdGHR9AS8CbOqjsXb8eRdXWk/L:TTG1HyCPU/4R958C8T
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/952-58-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/952-62-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/952-61-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/952-64-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1168 wrote to memory of 952 1168 5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe 27 PID 1168 wrote to memory of 952 1168 5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe 27 PID 1168 wrote to memory of 952 1168 5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe 27 PID 1168 wrote to memory of 952 1168 5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe"C:\Users\Admin\AppData\Local\Temp\5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5fa1ff00fe1ca9f6a99705fe581f437cfa46ec1f21a698f8c39578f3e0091752.exe?2⤵PID:952
-