Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 16:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b745d538cbc341804374d106e581d7a0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
b745d538cbc341804374d106e581d7a0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
120 seconds
General
-
Target
b745d538cbc341804374d106e581d7a0N.exe
-
Size
7KB
-
MD5
b745d538cbc341804374d106e581d7a0
-
SHA1
63434b936f437a70444e3f23131a618b9343d5a3
-
SHA256
905d1e0162c2e67cff1b46b72b401575155afbafd96d900ac8fc15c24764d51f
-
SHA512
6d4153cdc3887af588d67ba92b92c9d8e95f933e4b96636f347c3d8042196ad8aa8e2624926337e3f72ebdb0450d3d6eb715057db61a14a878b3612c353c5a06
-
SSDEEP
96:wr5N2tdaQIBUKcIWwH1coKdxz8baaQiQC1+a9c8:wodneUeWwV3KItQiQkXJ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2468 PurpleMood.scr 1252 PurpleMood.scr 3804 PurpleMood.scr 1324 PurpleMood.scr 2564 PurpleMood.scr 336 PurpleMood.scr 1112 PurpleMood.scr 2020 PurpleMood.scr 2804 PurpleMood.scr 832 PurpleMood.scr 1600 PurpleMood.scr 1784 PurpleMood.scr 1556 PurpleMood.scr 4600 PurpleMood.scr 5020 PurpleMood.scr 4420 PurpleMood.scr 440 PurpleMood.scr 984 PurpleMood.scr 1008 PurpleMood.scr 1988 PurpleMood.scr 4316 PurpleMood.scr 3760 PurpleMood.scr 2208 PurpleMood.scr 4156 PurpleMood.scr 4208 PurpleMood.scr 216 PurpleMood.scr 3500 PurpleMood.scr 4472 PurpleMood.scr 2196 PurpleMood.scr 5032 PurpleMood.scr 5068 PurpleMood.scr 4920 PurpleMood.scr 3688 PurpleMood.scr 3488 PurpleMood.scr 4692 PurpleMood.scr 2008 PurpleMood.scr 3476 PurpleMood.scr 3768 PurpleMood.scr 3304 PurpleMood.scr 3932 PurpleMood.scr 2812 PurpleMood.scr 3044 PurpleMood.scr 1176 PurpleMood.scr 1468 PurpleMood.scr 4072 PurpleMood.scr 2628 PurpleMood.scr 1424 PurpleMood.scr 1972 PurpleMood.scr 1012 PurpleMood.scr 448 PurpleMood.scr 4312 PurpleMood.scr 2132 PurpleMood.scr 1824 PurpleMood.scr 1492 PurpleMood.scr 1640 PurpleMood.scr 3480 PurpleMood.scr 3572 PurpleMood.scr 636 PurpleMood.scr 64 PurpleMood.scr 4784 PurpleMood.scr 3192 PurpleMood.scr 2016 PurpleMood.scr 3048 PurpleMood.scr 4988 PurpleMood.scr -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr PurpleMood.scr File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found File created C:\Windows\SysWOW64\PurpleMood.scr Process not Found -
Program crash 64 IoCs
pid pid_target Process procid_target 3372 3804 Process not Found 84 2480 2764 Process not Found 81 2228 2468 Process not Found 82 3204 1252 Process not Found 83 4716 3676 Process not Found 179 5748 1272 Process not Found 181 1988 1660 Process not Found 187 3536 4160 Process not Found 182 5720 6252 Process not Found 256 5664 6272 Process not Found 257 5940 6592 Process not Found 272 5212 6696 Process not Found 278 5636 7264 Process not Found 321 3392 7284 Process not Found 322 7320 7704 Process not Found 343 5892 7744 Process not Found 345 7684 9472 Process not Found 459 7968 10228 Process not Found 495 9684 10532 Process not Found 525 9916 10552 Process not Found 526 8452 11964 Process not Found 612 10884 11856 Process not Found 607 6624 12320 Process not Found 635 11260 11696 Process not Found 632 10732 13340 Process not Found 697 7752 13296 Process not Found 694 10924 13564 Process not Found 711 7032 13548 Process not Found 710 9460 14056 Process not Found 740 7392 14136 Process not Found 745 12652 14264 Process not Found 753 9876 14328 Process not Found 757 9076 14664 Process not Found 778 7424 14888 Process not Found 792 13112 15048 Process not Found 802 9016 15164 Process not Found 809 8208 15620 Process not Found 838 11456 16024 Process not Found 863 11576 16432 Process not Found 884 13200 16492 Process not Found 887 7044 16800 Process not Found 906 9444 17124 Process not Found 926 3596 17456 Process not Found 947 10408 17668 Process not Found 960 15008 17996 Process not Found 980 9500 18284 Process not Found 998 11792 18452 Process not Found 1009 9772 18740 Process not Found 1026 15996 18952 Process not Found 1039 13252 19172 Process not Found 1053 8552 19752 Process not Found 1090 16616 19688 Process not Found 1086 17052 20288 Process not Found 1123 11520 16380 Process not Found 1135 5892 20772 Process not Found 1154 2992 20884 Process not Found 1161 14276 21508 Process not Found 1201 13200 21752 Process not Found 1216 14532 21832 Process not Found 1221 17640 22008 Process not Found 1232 14880 22584 Process not Found 1268 11608 22796 Process not Found 1281 13832 22764 Process not Found 1279 14616 23052 Process not Found 1297 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurpleMood.scr -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2468 2764 b745d538cbc341804374d106e581d7a0N.exe 82 PID 2764 wrote to memory of 2468 2764 b745d538cbc341804374d106e581d7a0N.exe 82 PID 2764 wrote to memory of 2468 2764 b745d538cbc341804374d106e581d7a0N.exe 82 PID 2468 wrote to memory of 1252 2468 PurpleMood.scr 83 PID 2468 wrote to memory of 1252 2468 PurpleMood.scr 83 PID 2468 wrote to memory of 1252 2468 PurpleMood.scr 83 PID 1252 wrote to memory of 3804 1252 PurpleMood.scr 84 PID 1252 wrote to memory of 3804 1252 PurpleMood.scr 84 PID 1252 wrote to memory of 3804 1252 PurpleMood.scr 84 PID 3804 wrote to memory of 1324 3804 PurpleMood.scr 85 PID 3804 wrote to memory of 1324 3804 PurpleMood.scr 85 PID 3804 wrote to memory of 1324 3804 PurpleMood.scr 85 PID 1324 wrote to memory of 2564 1324 PurpleMood.scr 86 PID 1324 wrote to memory of 2564 1324 PurpleMood.scr 86 PID 1324 wrote to memory of 2564 1324 PurpleMood.scr 86 PID 2564 wrote to memory of 336 2564 PurpleMood.scr 87 PID 2564 wrote to memory of 336 2564 PurpleMood.scr 87 PID 2564 wrote to memory of 336 2564 PurpleMood.scr 87 PID 336 wrote to memory of 1112 336 PurpleMood.scr 88 PID 336 wrote to memory of 1112 336 PurpleMood.scr 88 PID 336 wrote to memory of 1112 336 PurpleMood.scr 88 PID 1112 wrote to memory of 2020 1112 PurpleMood.scr 89 PID 1112 wrote to memory of 2020 1112 PurpleMood.scr 89 PID 1112 wrote to memory of 2020 1112 PurpleMood.scr 89 PID 2020 wrote to memory of 2804 2020 PurpleMood.scr 90 PID 2020 wrote to memory of 2804 2020 PurpleMood.scr 90 PID 2020 wrote to memory of 2804 2020 PurpleMood.scr 90 PID 2804 wrote to memory of 832 2804 PurpleMood.scr 91 PID 2804 wrote to memory of 832 2804 PurpleMood.scr 91 PID 2804 wrote to memory of 832 2804 PurpleMood.scr 91 PID 832 wrote to memory of 1600 832 PurpleMood.scr 92 PID 832 wrote to memory of 1600 832 PurpleMood.scr 92 PID 832 wrote to memory of 1600 832 PurpleMood.scr 92 PID 1600 wrote to memory of 1784 1600 PurpleMood.scr 93 PID 1600 wrote to memory of 1784 1600 PurpleMood.scr 93 PID 1600 wrote to memory of 1784 1600 PurpleMood.scr 93 PID 1784 wrote to memory of 1556 1784 PurpleMood.scr 94 PID 1784 wrote to memory of 1556 1784 PurpleMood.scr 94 PID 1784 wrote to memory of 1556 1784 PurpleMood.scr 94 PID 1556 wrote to memory of 4600 1556 PurpleMood.scr 95 PID 1556 wrote to memory of 4600 1556 PurpleMood.scr 95 PID 1556 wrote to memory of 4600 1556 PurpleMood.scr 95 PID 4600 wrote to memory of 5020 4600 PurpleMood.scr 96 PID 4600 wrote to memory of 5020 4600 PurpleMood.scr 96 PID 4600 wrote to memory of 5020 4600 PurpleMood.scr 96 PID 5020 wrote to memory of 4420 5020 PurpleMood.scr 97 PID 5020 wrote to memory of 4420 5020 PurpleMood.scr 97 PID 5020 wrote to memory of 4420 5020 PurpleMood.scr 97 PID 4420 wrote to memory of 440 4420 PurpleMood.scr 98 PID 4420 wrote to memory of 440 4420 PurpleMood.scr 98 PID 4420 wrote to memory of 440 4420 PurpleMood.scr 98 PID 440 wrote to memory of 984 440 PurpleMood.scr 100 PID 440 wrote to memory of 984 440 PurpleMood.scr 100 PID 440 wrote to memory of 984 440 PurpleMood.scr 100 PID 984 wrote to memory of 1008 984 PurpleMood.scr 101 PID 984 wrote to memory of 1008 984 PurpleMood.scr 101 PID 984 wrote to memory of 1008 984 PurpleMood.scr 101 PID 1008 wrote to memory of 1988 1008 PurpleMood.scr 102 PID 1008 wrote to memory of 1988 1008 PurpleMood.scr 102 PID 1008 wrote to memory of 1988 1008 PurpleMood.scr 102 PID 1988 wrote to memory of 4316 1988 PurpleMood.scr 103 PID 1988 wrote to memory of 4316 1988 PurpleMood.scr 103 PID 1988 wrote to memory of 4316 1988 PurpleMood.scr 103 PID 4316 wrote to memory of 3760 4316 PurpleMood.scr 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b745d538cbc341804374d106e581d7a0N.exe"C:\Users\Admin\AppData\Local\Temp\b745d538cbc341804374d106e581d7a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr23⤵
- Executes dropped EXE
PID:3760 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr24⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr25⤵
- Executes dropped EXE
PID:4156 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr26⤵
- Executes dropped EXE
PID:4208 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr27⤵
- Executes dropped EXE
PID:216 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr28⤵
- Executes dropped EXE
PID:3500 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr29⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr30⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr31⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr32⤵
- Executes dropped EXE
PID:5068 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr33⤵
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr34⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr35⤵
- Executes dropped EXE
PID:3488 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr36⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr37⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr38⤵
- Executes dropped EXE
PID:3476 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr39⤵
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr40⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr41⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr42⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr43⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr44⤵
- Executes dropped EXE
PID:1176 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr45⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr46⤵
- Executes dropped EXE
PID:4072 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr47⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr48⤵
- Executes dropped EXE
PID:1424 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr49⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr50⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr51⤵
- Executes dropped EXE
PID:448 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr52⤵
- Executes dropped EXE
PID:4312 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr53⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr54⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr55⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr56⤵
- Executes dropped EXE
PID:1640 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr57⤵
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr58⤵
- Executes dropped EXE
PID:3572 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr59⤵
- Executes dropped EXE
PID:636 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr60⤵
- Executes dropped EXE
PID:64 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr61⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr62⤵
- Executes dropped EXE
PID:3192 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr63⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr64⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr65⤵
- Executes dropped EXE
PID:4988 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr66⤵PID:804
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr67⤵PID:4288
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr68⤵PID:4344
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr69⤵PID:1728
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr70⤵PID:3168
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr71⤵PID:2268
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr72⤵PID:1136
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr73⤵PID:3744
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr74⤵PID:828
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr75⤵
- Drops file in System32 directory
PID:4544 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr76⤵PID:2884
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr77⤵PID:5092
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr78⤵PID:2040
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr79⤵PID:2860
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr80⤵PID:5108
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr81⤵PID:3164
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr82⤵PID:1768
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr83⤵PID:648
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr84⤵PID:3388
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr85⤵PID:5104
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr86⤵PID:1340
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr87⤵PID:4168
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr88⤵PID:4492
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr89⤵PID:1684
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr90⤵PID:1056
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr91⤵PID:3024
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr92⤵PID:5056
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr93⤵PID:4248
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr94⤵PID:3676
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr95⤵PID:4676
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr96⤵PID:1272
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr97⤵PID:4160
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr98⤵PID:2340
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr99⤵PID:2828
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr100⤵PID:2272
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr101⤵PID:1956
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr102⤵PID:1660
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr103⤵PID:3400
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr104⤵PID:5128
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr105⤵PID:5148
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr106⤵PID:5168
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr107⤵PID:5188
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr108⤵PID:5208
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr109⤵PID:5228
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr110⤵PID:5248
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr111⤵PID:5268
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr112⤵PID:5292
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr113⤵PID:5312
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr114⤵PID:5332
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr115⤵
- Drops file in System32 directory
PID:5352 -
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr116⤵PID:5372
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr117⤵PID:5392
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr118⤵PID:5412
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr119⤵PID:5432
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr120⤵PID:5460
-
C:\Windows\SysWOW64\PurpleMood.scrC:\Windows\system32\PurpleMood.scr121⤵PID:5476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-