Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 09:58
Static task
static1
Behavioral task
behavioral1
Sample
4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll
Resource
win10v2004-20220812-en
General
-
Target
4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll
-
Size
6KB
-
MD5
13515a91cfe209b0f5f7e549dc691ae0
-
SHA1
31d3cbf90f168633621617ef944918ed70601e1a
-
SHA256
4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f
-
SHA512
2cc3da5d68d962c0e544e0aa851816b9647d8dd59c658a334c58821b0035a4ab87bb166f4bac3b0229889ccedae88e7e2bafcaf34a58dd7758b18bb76d7a5001
-
SSDEEP
96:nI2RrUeqnnQ66lj//NuHIUJlKKQ84RmO:XR4eA0ljaITbRmO
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1196 1976 rundll32.exe 27 PID 1976 wrote to memory of 1196 1976 rundll32.exe 27 PID 1976 wrote to memory of 1196 1976 rundll32.exe 27 PID 1976 wrote to memory of 1196 1976 rundll32.exe 27 PID 1976 wrote to memory of 1196 1976 rundll32.exe 27 PID 1976 wrote to memory of 1196 1976 rundll32.exe 27 PID 1976 wrote to memory of 1196 1976 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a30b93c8bd1937aceb8f711bf5d9828f3302f31251e196f292f824a92e5544f.dll,#12⤵PID:1196
-