Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
3f65d624cb5b9207a79ac109665b8e3d.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f65d624cb5b9207a79ac109665b8e3d.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
3f65d624cb5b9207a79ac109665b8e3d.exe
-
Size
568KB
-
MD5
3f65d624cb5b9207a79ac109665b8e3d
-
SHA1
983e21d376e22f3a5cd8c9e302d975888f8cbb9c
-
SHA256
124333e2243474ce51cb0721a647e3daf18c3d1896f46b10da019599a137cb92
-
SHA512
e9ff5d9e00a1cff3cac3f170f63b86f84f0b740f9fe52c7027220a1775dba0b69e1d53378fb646628779f61c4e5b771ed7ffdfe4d35312134ad20e901af00de8
-
SSDEEP
12288:Hs37fF9v68N4QzNTbLrEMfb7Io46bu8euR5agNUW:mfzv68OQzNk6bUEugNUW
Score
1/10
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 3 IoCs
pid Process 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 3032 3f65d624cb5b9207a79ac109665b8e3d.exe 2084 3f65d624cb5b9207a79ac109665b8e3d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1748 wrote to memory of 3032 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 28 PID 1748 wrote to memory of 3032 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 28 PID 1748 wrote to memory of 3032 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 28 PID 1748 wrote to memory of 3032 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 28 PID 1748 wrote to memory of 2084 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 29 PID 1748 wrote to memory of 2084 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 29 PID 1748 wrote to memory of 2084 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 29 PID 1748 wrote to memory of 2084 1748 3f65d624cb5b9207a79ac109665b8e3d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f65d624cb5b9207a79ac109665b8e3d.exe"C:\Users\Admin\AppData\Local\Temp\3f65d624cb5b9207a79ac109665b8e3d.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3f65d624cb5b9207a79ac109665b8e3d.exestart2⤵
- Suspicious use of UnmapMainImage
PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\3f65d624cb5b9207a79ac109665b8e3d.exewatch2⤵
- Suspicious use of UnmapMainImage
PID:2084
-