Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll
Resource
win7-20220901-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll
Resource
win10v2004-20220901-en
1 signatures
150 seconds
General
-
Target
9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll
-
Size
3KB
-
MD5
47e1f9589c58005c0e1975886ee85868
-
SHA1
fc89928df11afb73140ab236aab493d027dbc1a3
-
SHA256
9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb
-
SHA512
d9f0781ee07f8322b537650825354c0a79a4d2bd3c3d769fc53d61ad251efdc167c4ac028d4bf4e9563704b6cd4c7000a62e7363987bd8a7764262d6a08acb63
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll,#12⤵PID:1708
-