Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 03:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
271f20810b3bde2aea977e58adcf664a.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
271f20810b3bde2aea977e58adcf664a.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
271f20810b3bde2aea977e58adcf664a.exe
-
Size
43KB
-
MD5
271f20810b3bde2aea977e58adcf664a
-
SHA1
b190e2587997f076b58cc87da87d8c85723d50cf
-
SHA256
39a782015a3fd6125581719350115a91d3ab461772bf55cd03121dcaf22b5100
-
SHA512
d6bd0603c3afda37379cff28aa5c20a8102945b5c69a839712e0b161a157c1f95ffdce870cc81b3d3ea2f9ac4967e50b542a5cc2b234cbc5796196e981774c0b
-
SSDEEP
768:RJSr21Uis2hxFL07zYZuZPWVxcI77OMaF2IT9ala22MBdWjEyZpV+kjS29TbtX:R42S6wAiWVxRroT9ala22MHWjEyp+0lV
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2972 set thread context of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2408 271f20810b3bde2aea977e58adcf664a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91 PID 2972 wrote to memory of 2408 2972 271f20810b3bde2aea977e58adcf664a.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"2⤵
- Suspicious use of UnmapMainImage
PID:2408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2408 -ip 24081⤵PID:4004