Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 09:58
Behavioral task
behavioral1
Sample
PEYSOHAVX.exe
Resource
win7-20240508-en
General
-
Target
PEYSOHAVX.exe
-
Size
8.3MB
-
MD5
491c23ecd3104bd6b27952da53d3ba38
-
SHA1
a29458cb6006528b1f1792dcd56ce631f0a2e332
-
SHA256
3c9105d0c851b8cba35908d00707e447198b04e85995e48c92077b2e7b24b9c0
-
SHA512
b72886c24b051441f187ce825ddbc5ca23afdf0650027a7519e40cac1131023efd71d561730a4f7232a21c40c5fa87ba7d75fed7221bc63d9cd5743925d7fd89
-
SSDEEP
196608:Mrzi0cDeTIE0OiLjv+bhqNVoBKUh8mz4Iv9Plu1D7A7:kieU4GL+9qz8/b4IzuRA7
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2572 PEYSOHAVX.exe -
resource yara_rule behavioral1/files/0x0005000000019381-22.dat upx behavioral1/memory/2572-24-0x000007FEF5750000-0x000007FEF5D39000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2572 2920 PEYSOHAVX.exe 28 PID 2920 wrote to memory of 2572 2920 PEYSOHAVX.exe 28 PID 2920 wrote to memory of 2572 2920 PEYSOHAVX.exe 28
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f