Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 05:36
Static task
static1
Behavioral task
behavioral1
Sample
0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
Resource
win10v2004-20220901-en
General
-
Target
0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
-
Size
128KB
-
MD5
342fb27ff4831b3a7000170fea897a66
-
SHA1
4adc0ba6dac2937af6eccbca257cfdbe25cf1961
-
SHA256
0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9
-
SHA512
ca7cd8712e716ef8bcb5dd11e7065041f5a3fbd97318997f423755a1253c1b0e081ea1b5027c819fa18eab53d86c034672ea716c1d8921c759c7245d6ffb7a27
-
SSDEEP
3072:OdEdnvOjI0evGkPTFEUuEU78WG0RO9uQoFEw/7rG9KVuaduMyZFzLr2n5lhRTY1:D0ROQYSyfj25HR+
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 992 wrote to memory of 1888 992 regsvr32.exe 27 PID 992 wrote to memory of 1888 992 regsvr32.exe 27 PID 992 wrote to memory of 1888 992 regsvr32.exe 27 PID 992 wrote to memory of 1888 992 regsvr32.exe 27 PID 992 wrote to memory of 1888 992 regsvr32.exe 27 PID 992 wrote to memory of 1888 992 regsvr32.exe 27 PID 992 wrote to memory of 1888 992 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll1⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll2⤵PID:1888
-