Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 21:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b49468ec40fd1bb6adfc01eb556c669.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
7b49468ec40fd1bb6adfc01eb556c669.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
7b49468ec40fd1bb6adfc01eb556c669.exe
-
Size
28KB
-
MD5
7b49468ec40fd1bb6adfc01eb556c669
-
SHA1
739b304796ee20af5c23ea11862c77ec5a763100
-
SHA256
7e393cf12da66c993872d3930afd9429ae0e6451fe52b854fbc856dec848ca5c
-
SHA512
c27647c430109576d40abc48b4991f945cef09f73fa4a5b5c0ac9764cfb3d2d7c7b461ff18f8ea5570db20a1a9afd4a0a817d418ac45c19691be9f5dbb6a9639
-
SSDEEP
384:UmOyMLjKMPH1Dxw7ZA8l9ZoA7k+w9G5hmssR0IkR46nzojn8mgRRtssIeo/r5J1R:hUjKVjl9xw3x6nz7vj1wr/
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 2088 7b49468ec40fd1bb6adfc01eb556c669.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2088 wrote to memory of 3404 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 45 PID 2088 wrote to memory of 3404 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 45 PID 2088 wrote to memory of 3404 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 45 PID 2088 wrote to memory of 3404 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 45 PID 2088 wrote to memory of 3404 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 45 PID 2088 wrote to memory of 3404 2088 7b49468ec40fd1bb6adfc01eb556c669.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b49468ec40fd1bb6adfc01eb556c669.exe"C:\Users\Admin\AppData\Local\Temp\7b49468ec40fd1bb6adfc01eb556c669.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3404