Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
654227aa321024a69f5e0a5016d7597fbb30cb9bb4ed68d395be768b850ad56a.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
654227aa321024a69f5e0a5016d7597fbb30cb9bb4ed68d395be768b850ad56a.dll
Resource
win10v2004-20220812-en
General
-
Target
654227aa321024a69f5e0a5016d7597fbb30cb9bb4ed68d395be768b850ad56a.dll
-
Size
5KB
-
MD5
69d7dcef927e5a7bd73cb278d0def3d0
-
SHA1
3c7de9fca134d222f2d8600c0c71a4a4a0a00da0
-
SHA256
654227aa321024a69f5e0a5016d7597fbb30cb9bb4ed68d395be768b850ad56a
-
SHA512
bf539eb0ce754fddae455f8beed14faaae5f8637baee5c7a698efdc89527f71da4f5cbc98a3fc32993d1db1a4963f8322025150fc1a5b7a41d0f6599fbd564e3
-
SSDEEP
96:6ikQX1kpHgLyqDMP2Y55DRe2vl9BM4YQ82dN:9XGecP2ExLvl9Bb7
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1992 1980 rundll32.exe 27 PID 1980 wrote to memory of 1992 1980 rundll32.exe 27 PID 1980 wrote to memory of 1992 1980 rundll32.exe 27 PID 1980 wrote to memory of 1992 1980 rundll32.exe 27 PID 1980 wrote to memory of 1992 1980 rundll32.exe 27 PID 1980 wrote to memory of 1992 1980 rundll32.exe 27 PID 1980 wrote to memory of 1992 1980 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\654227aa321024a69f5e0a5016d7597fbb30cb9bb4ed68d395be768b850ad56a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\654227aa321024a69f5e0a5016d7597fbb30cb9bb4ed68d395be768b850ad56a.dll,#12⤵PID:1992
-