Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 21:51
Static task
static1
Behavioral task
behavioral1
Sample
d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll
-
Size
3KB
-
MD5
6f30729ed38755d62feb31f62d3e2679
-
SHA1
639e7c94f0434006c27fac4f86766f899561a4a1
-
SHA256
d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a
-
SHA512
6b2e9ace812ffcdc1f211b19ad02685f4ea4eb6389ba661e1c749e9dda3a256a0c5f710ca5cb34f75df8e4a008f1ef093955004127c548cdafe76dc0423ec6dd
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1812 wrote to memory of 896 1812 rundll32.exe 28 PID 1812 wrote to memory of 896 1812 rundll32.exe 28 PID 1812 wrote to memory of 896 1812 rundll32.exe 28 PID 1812 wrote to memory of 896 1812 rundll32.exe 28 PID 1812 wrote to memory of 896 1812 rundll32.exe 28 PID 1812 wrote to memory of 896 1812 rundll32.exe 28 PID 1812 wrote to memory of 896 1812 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll,#12⤵PID:896
-