Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe
Resource
win10v2004-20220812-en
General
-
Target
11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe
-
Size
136KB
-
MD5
5a9e0dcac04841e8cf465b8f79bee5eb
-
SHA1
d100d2ce08afaeec56862dc27cf67f4a36378dc7
-
SHA256
11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb
-
SHA512
37aaaaf299eeeb8cf646d3eec1887bf36bcdd37fe2ebca28639f265d7ec18d1f948bb31c457a07b2ab7bf981df4d269cfbb2eab6fd571a79453a72edf71f1590
-
SSDEEP
3072:KTG1QgKy/250yv9+ACbOqjsXb8eKI0JhOUvwrhUN9PU/K:KTG1HKyY07ACzlD5
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1864-58-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/1864-61-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/1864-62-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/1864-64-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1280 wrote to memory of 1864 1280 11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe 27 PID 1280 wrote to memory of 1864 1280 11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe 27 PID 1280 wrote to memory of 1864 1280 11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe 27 PID 1280 wrote to memory of 1864 1280 11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe"C:\Users\Admin\AppData\Local\Temp\11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\11e3e23e04f7d9106977fc5e11d6b70a05a045c19a111dd2fa0be7c3d32e20bb.exe?2⤵PID:1864
-