Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 02:32
Behavioral task
behavioral1
Sample
81d80b90eef28575ea97ccd240fe6bb4.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
81d80b90eef28575ea97ccd240fe6bb4.exe
Resource
win10v2004-20240802-en
1 signatures
150 seconds
General
-
Target
81d80b90eef28575ea97ccd240fe6bb4.exe
-
Size
1.1MB
-
MD5
81d80b90eef28575ea97ccd240fe6bb4
-
SHA1
8dc69d9af765c84032cb6e44517ab51efe0e0727
-
SHA256
511b01c958591807a6ce13b59f3d211576749f0074610f42dd5e2a44860a14c2
-
SHA512
5df730f6614268a29f30d91c2fb582f7a01f65d4df9ae56d3b511fff5c9d8904a65165c5b2ca23dbf9a00b0be2b3845cf67d207846a85b1bd66e2316d58a9362
-
SSDEEP
24576:2VOlRgi+jIBVelUAvbUFUupC0f3/Jy7WKcxRVjlxEEcs:2egi+OklUMbUSupR86VZSs
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1716-7-0x0000000000400000-0x000000000051F000-memory.dmp themida -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1716 81d80b90eef28575ea97ccd240fe6bb4.exe 1716 81d80b90eef28575ea97ccd240fe6bb4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1204 1716 81d80b90eef28575ea97ccd240fe6bb4.exe 21 PID 1716 wrote to memory of 1204 1716 81d80b90eef28575ea97ccd240fe6bb4.exe 21 PID 1716 wrote to memory of 1204 1716 81d80b90eef28575ea97ccd240fe6bb4.exe 21 PID 1716 wrote to memory of 1204 1716 81d80b90eef28575ea97ccd240fe6bb4.exe 21 PID 1716 wrote to memory of 1204 1716 81d80b90eef28575ea97ccd240fe6bb4.exe 21 PID 1716 wrote to memory of 1204 1716 81d80b90eef28575ea97ccd240fe6bb4.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\81d80b90eef28575ea97ccd240fe6bb4.exe"C:\Users\Admin\AppData\Local\Temp\81d80b90eef28575ea97ccd240fe6bb4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1716
-