Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll
Resource
win10v2004-20220812-en
General
-
Target
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll
-
Size
132KB
-
MD5
1a6390ec5e3c8c9851396cb2dae5295c
-
SHA1
2b12bf4ed6742f3fbded0aba94c6ab6311e2c72c
-
SHA256
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848
-
SHA512
7064955f29a2e32870fe0a89a656ec43d074aa27f6fb9378a1ce05d7060c01685ecd3a5b59a88a811da4b5fd01ab048963bc66b6398749582da061dba0302b23
-
SSDEEP
3072:3ffqwt4wIqYhb5tgL6TcI6xQcgDmDQV7xmM0pI5aghOjRFlkHGe2:3KweW00Latn7MZI5XOjH
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1672 1736 rundll32.exe 28 PID 1736 wrote to memory of 1672 1736 rundll32.exe 28 PID 1736 wrote to memory of 1672 1736 rundll32.exe 28 PID 1736 wrote to memory of 1672 1736 rundll32.exe 28 PID 1736 wrote to memory of 1672 1736 rundll32.exe 28 PID 1736 wrote to memory of 1672 1736 rundll32.exe 28 PID 1736 wrote to memory of 1672 1736 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll,#12⤵PID:1672
-