Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 13:42
Behavioral task
behavioral1
Sample
baa42cedd599bfc749b2f51326e66fe90e6b93591951606f113b0dc4baa65346.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
baa42cedd599bfc749b2f51326e66fe90e6b93591951606f113b0dc4baa65346.dll
Resource
win10v2004-20220812-en
General
-
Target
baa42cedd599bfc749b2f51326e66fe90e6b93591951606f113b0dc4baa65346.dll
-
Size
60KB
-
MD5
61b30f54313d03c28359a8c5b8970f98
-
SHA1
295b44d7d7b3a86dae0e1d75215345a75d8eede6
-
SHA256
baa42cedd599bfc749b2f51326e66fe90e6b93591951606f113b0dc4baa65346
-
SHA512
3536aeb1fe5e6fe2753198a765fa484820bbe8c9647aaf339446f13303c7105871dd72e88bc882edddd5fcded0c659a0257090aa7ff2e603db2fb69e55e147a1
-
SSDEEP
1536:4XkTnJx7vaUjL+kD/uU8diOPgZHKV9gvrTFMuwN:SKJxz5Lt2ifIgvrT14
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1696 wrote to memory of 944 1696 rundll32.exe 27 PID 1696 wrote to memory of 944 1696 rundll32.exe 27 PID 1696 wrote to memory of 944 1696 rundll32.exe 27 PID 1696 wrote to memory of 944 1696 rundll32.exe 27 PID 1696 wrote to memory of 944 1696 rundll32.exe 27 PID 1696 wrote to memory of 944 1696 rundll32.exe 27 PID 1696 wrote to memory of 944 1696 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\baa42cedd599bfc749b2f51326e66fe90e6b93591951606f113b0dc4baa65346.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\baa42cedd599bfc749b2f51326e66fe90e6b93591951606f113b0dc4baa65346.dll,#12⤵PID:944
-