Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/01/2023, 11:41
230113-nthbwsgf38 1012/01/2023, 16:59
230112-vhc2csgg84 511/01/2023, 18:21
230111-wzsntahf31 5Analysis
-
max time kernel
44s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
12/01/2023, 16:59
Static task
static1
Behavioral task
behavioral1
Sample
Software.exe
Resource
win7-20221111-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Software.exe
Resource
win10v2004-20221111-en
4 signatures
150 seconds
General
-
Target
Software.exe
-
Size
449.2MB
-
MD5
d5f6325ec94040f2a6ad638378f68863
-
SHA1
b577eebec521d0c252426ce01d0a85e405619e84
-
SHA256
87c7a6eb8d9ec5de571f3f3283d2b5f857d2eb9a262ccb11d9cbae9da8b649af
-
SHA512
9da7cb47b04618d05c0477656c82f500080e6b4325eefe5f4d87d3d11a171fcbcfe830b676e419961378217be2c9a93040c361ae30c62de1a39d76e921bb06eb
-
SSDEEP
24576:Rgh/xuMApac4x8buUjQs5nyyx+NxEyaQ:ih/rApz4xauUMs5nyC+NqyaQ
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 616 set thread context of 584 616 Software.exe 28 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28 PID 616 wrote to memory of 584 616 Software.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Software.exe"C:\Users\Admin\AppData\Local\Temp\Software.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\Software.exe"C:\Users\Admin\AppData\Local\Temp\Software.exe"2⤵PID:584
-