Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 21:29
Behavioral task
behavioral1
Sample
0478a669b53eb7cee01d54f99a4996cf.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0478a669b53eb7cee01d54f99a4996cf.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
0478a669b53eb7cee01d54f99a4996cf.exe
-
Size
100KB
-
MD5
0478a669b53eb7cee01d54f99a4996cf
-
SHA1
d37b20eacdb912d039b8294bafeb808c2c5ea6e2
-
SHA256
ac7176554d7ae30143aea9da636af584a372dbfed1a2e8d5f0f4aff7bcb3fef5
-
SHA512
20cb2c95e901b9bbf190a32fe8e715a21abb6809f19b0020659c7c9a078dd39a2dfd48a93dda088646e180ea6cccb1b01eff5ad8428ba431a0b499d3818037dd
-
SSDEEP
1536:ysuHhi9EpmecjOEDA4atlc9fcK/2RKLHa18FkqS/11ar1Mh4HZmWep:Hui9E4fA4atQd/MKja+Y/110Mm5mrp
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2508 0478a669b53eb7cee01d54f99a4996cf.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2476 2508 0478a669b53eb7cee01d54f99a4996cf.exe 20 PID 2508 wrote to memory of 2476 2508 0478a669b53eb7cee01d54f99a4996cf.exe 20 PID 2508 wrote to memory of 2476 2508 0478a669b53eb7cee01d54f99a4996cf.exe 20 PID 2508 wrote to memory of 2476 2508 0478a669b53eb7cee01d54f99a4996cf.exe 20 PID 2508 wrote to memory of 2476 2508 0478a669b53eb7cee01d54f99a4996cf.exe 20 PID 2508 wrote to memory of 2476 2508 0478a669b53eb7cee01d54f99a4996cf.exe 20 PID 2508 wrote to memory of 2476 2508 0478a669b53eb7cee01d54f99a4996cf.exe 20