Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 10:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ce6c417c4dcc18d3814be3952a7f59a.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ce6c417c4dcc18d3814be3952a7f59a.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
7ce6c417c4dcc18d3814be3952a7f59a.exe
-
Size
43KB
-
MD5
7ce6c417c4dcc18d3814be3952a7f59a
-
SHA1
3a65c1ff41bcad70af40d75465256ebaeed77994
-
SHA256
ecaa1c280350845a2c043a7d3244efefc8a671291f81b81cec0060af1ce198ca
-
SHA512
cfb016b4a4d3b9ec0cee411016e69aba91f8323f1e0200256503f4c795ad089527f738141909dbd3dfa0f88d1de633d01a18836fef884b5385267affa7ab0a25
-
SSDEEP
768:wC19DlJj0nxV8gMxXyyAdCWM67ayAZCQ3th5aO2rqsNwiE0Q14Psr7DL:wCPRzxXG57aylQ9hr1svE084kP
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3356 set thread context of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3356 wrote to memory of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86 PID 3356 wrote to memory of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86 PID 3356 wrote to memory of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86 PID 3356 wrote to memory of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86 PID 3356 wrote to memory of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86 PID 3356 wrote to memory of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86 PID 3356 wrote to memory of 5012 3356 7ce6c417c4dcc18d3814be3952a7f59a.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"2⤵PID:5012
-