Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
Resource
win10v2004-20220812-en
General
-
Target
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
-
Size
343KB
-
MD5
664d6e7b21d44375d158d70548f35cbe
-
SHA1
d2734b774b18c6aefb2c420fafbf2cf8c7997a96
-
SHA256
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee
-
SHA512
08915f8c3055a4db327ba553614090661b5467cd0a5c929895bea0988fbc4775a5b5a9723732fe266913551d43924f0a0a0d1159cab1594d00fd78c83c3959fa
-
SSDEEP
3072:R/+JR2BNtlt0ntfjNOVzV5kqTX0nj5XEAprAgSJUJP28ZulWsXbds:R/+JR2BNtlt0trN1nhEApkggqPHZLZ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1072 2008 rundll32.exe 27 PID 2008 wrote to memory of 1072 2008 rundll32.exe 27 PID 2008 wrote to memory of 1072 2008 rundll32.exe 27 PID 2008 wrote to memory of 1072 2008 rundll32.exe 27 PID 2008 wrote to memory of 1072 2008 rundll32.exe 27 PID 2008 wrote to memory of 1072 2008 rundll32.exe 27 PID 2008 wrote to memory of 1072 2008 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#12⤵PID:1072
-