Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18/09/2022, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
f9b19f82c08a309f5b84c942759ab0733b7902698b25bcee2daff330ca5a88ea.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f9b19f82c08a309f5b84c942759ab0733b7902698b25bcee2daff330ca5a88ea.dll
Resource
win10v2004-20220812-en
General
-
Target
f9b19f82c08a309f5b84c942759ab0733b7902698b25bcee2daff330ca5a88ea.dll
-
Size
36KB
-
MD5
6beb1f16382c1b3952117c06bb615292
-
SHA1
2166a94da28fd0e137810481d8e9a77fd0ff477c
-
SHA256
f9b19f82c08a309f5b84c942759ab0733b7902698b25bcee2daff330ca5a88ea
-
SHA512
d4c46b0bc0901e0ae4b9dfa8eed290497a71cd43a67505dcf2dcf1f5bdb99846b712e18f7ab6b6a428cbb9cec0a39c3331634261c0c48291eb678e6a1c8a7c71
-
SSDEEP
768:GN53hJbyNbNON0lQwuXgcR1pV7Oq7Kj95hNDRR0VAZmLUbD:2xByNbN+eqgcRF7V7YvdR0VAFD
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 752 wrote to memory of 1584 752 rundll32.exe 28 PID 752 wrote to memory of 1584 752 rundll32.exe 28 PID 752 wrote to memory of 1584 752 rundll32.exe 28 PID 752 wrote to memory of 1584 752 rundll32.exe 28 PID 752 wrote to memory of 1584 752 rundll32.exe 28 PID 752 wrote to memory of 1584 752 rundll32.exe 28 PID 752 wrote to memory of 1584 752 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b19f82c08a309f5b84c942759ab0733b7902698b25bcee2daff330ca5a88ea.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b19f82c08a309f5b84c942759ab0733b7902698b25bcee2daff330ca5a88ea.dll,#12⤵PID:1584
-