Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/09/2022, 20:18
Behavioral task
behavioral1
Sample
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll
Resource
win10v2004-20220812-en
General
-
Target
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll
-
Size
211KB
-
MD5
0812cff728905cfc0c57d6dcb23f71a5
-
SHA1
b3819e9184e9faa97eca73a433b70ca771003948
-
SHA256
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226
-
SHA512
fd386ef3eb75d5e87f476e24df0271683b61160688fc68112d30e553e84441ac4caae6a74e7524dbf8efb3b19795095cd9228911c9c1a6814754804c7a5c5840
-
SSDEEP
6144:jE3vt8VkomMsQs66Kj0TfyVbZFhIdloSsUv2:4GV2MsQs66A0TfybFiPoSbv
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 456 wrote to memory of 1992 456 rundll32.exe 28 PID 456 wrote to memory of 1992 456 rundll32.exe 28 PID 456 wrote to memory of 1992 456 rundll32.exe 28 PID 456 wrote to memory of 1992 456 rundll32.exe 28 PID 456 wrote to memory of 1992 456 rundll32.exe 28 PID 456 wrote to memory of 1992 456 rundll32.exe 28 PID 456 wrote to memory of 1992 456 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll,#12⤵PID:1992
-