Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 13:34
Static task
static1
Behavioral task
behavioral1
Sample
99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe
Resource
win10v2004-20240802-en
General
-
Target
99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe
-
Size
644KB
-
MD5
790fa5ba59b19c53b06cf6c132d7c351
-
SHA1
328f8c47aa968bd5750fb7f46fbb121f81a8f18f
-
SHA256
99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3
-
SHA512
f3939d2629e1177953b35dbcc66c044d66b47de8c949fb811e335f38b242629d037f1f71fcc4b25d72cb68f469679119f82ce6c0527a7b0230941a6c58300a58
-
SSDEEP
6144:qqyk1xZBq65kzLy9tEoEtKE0rdOr1+BhK629PRkY1:qqy2Zo65kzLy92oIt0graIoe
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2620 3060 99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe 31 PID 3060 wrote to memory of 2620 3060 99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe 31 PID 3060 wrote to memory of 2620 3060 99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe 31 PID 3060 wrote to memory of 824 3060 99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe 32 PID 3060 wrote to memory of 824 3060 99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe 32 PID 3060 wrote to memory of 824 3060 99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe"C:\Users\Admin\AppData\Local\Temp\99bf3e029228a469a05da0dd317f02620577a054766424c4ea83e0d0820fe6d3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\system32\notepad.exenotepad.exe2⤵PID:2620
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3060 -s 1282⤵PID:824
-