Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
dc1a71f3165372ff08df0794d0c98d8194de188e89aa0bfac973240f14003941.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dc1a71f3165372ff08df0794d0c98d8194de188e89aa0bfac973240f14003941.dll
Resource
win10v2004-20220812-en
General
-
Target
dc1a71f3165372ff08df0794d0c98d8194de188e89aa0bfac973240f14003941.dll
-
Size
8KB
-
MD5
7326cef584f120bb1d2e8b793ab16c3d
-
SHA1
f1ebca90febaa44dc730cc90ebe8832fa0bca2e2
-
SHA256
dc1a71f3165372ff08df0794d0c98d8194de188e89aa0bfac973240f14003941
-
SHA512
036317beebe123a87f5b4904dd10a4d219da09017e4fd28c97d52e084d843304c290bfbe7362bd35a96b6781427be590731766fabbac418607a168563eb20b83
-
SSDEEP
192:nzF8rA/xdowlOJAGGwlGVfjJWa/Zt2DIG:zyE/o8OjGwlGVfj8CmIG
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 908 wrote to memory of 2036 908 rundll32.exe 27 PID 908 wrote to memory of 2036 908 rundll32.exe 27 PID 908 wrote to memory of 2036 908 rundll32.exe 27 PID 908 wrote to memory of 2036 908 rundll32.exe 27 PID 908 wrote to memory of 2036 908 rundll32.exe 27 PID 908 wrote to memory of 2036 908 rundll32.exe 27 PID 908 wrote to memory of 2036 908 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc1a71f3165372ff08df0794d0c98d8194de188e89aa0bfac973240f14003941.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc1a71f3165372ff08df0794d0c98d8194de188e89aa0bfac973240f14003941.dll,#12⤵PID:2036
-