Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:33
Behavioral task
behavioral1
Sample
1e938f9ae586d0c5652aeae4d3ae8992.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e938f9ae586d0c5652aeae4d3ae8992.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1e938f9ae586d0c5652aeae4d3ae8992.exe
-
Size
5KB
-
MD5
1e938f9ae586d0c5652aeae4d3ae8992
-
SHA1
8c67fe2b05ec3105d1f94beb8b9600f16f481549
-
SHA256
60307a0fea5671efd4c0d0cc26045fe8d5866a97efc7e010b269ea501ba7e3d0
-
SHA512
0ca807fcec5aa08c64648a127c991359123d4475b52eeb5f8e0e759c5075b4a478d28037a73c6f5be2f0b12a6ef4539f51e34367a3684262a67e381071deb3f1
-
SSDEEP
96:uroKhNleNv3FHXWnDlfGnIQ3lH06dEwlIhC8cliyYo:urLIfFHXUOIQVH0Utm7q
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2800-0-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2800-1-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2404 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 15 PID 2800 wrote to memory of 2404 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 15 PID 2800 wrote to memory of 2404 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 15 PID 2800 wrote to memory of 2404 2800 1e938f9ae586d0c5652aeae4d3ae8992.exe 15