Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll
Resource
win10v2004-20220812-en
General
-
Target
ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll
-
Size
19KB
-
MD5
12a7e662ebd1b63d172db9232ba67cb0
-
SHA1
faab9e3171614bbf0eafcf53b99bd62ad32cfdf0
-
SHA256
ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b
-
SHA512
0acf73107caceaa7cca85df4809bdcfac31caafb99032270d94b7d8880f3600bd65ad97f93134eea3a0db877100c5ec4800a4ecfe34923d103903c412b722a06
-
SSDEEP
384:f7/n22ITPgfEhDsrQ800i80zY4+j7JdZgU0FaXE8:f7/nyPhhDsGn80zpW7JdZgtFaXE
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1272 rundll32.exe 3 1272 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ef6dfcec7a338ad05ec03bf5cfac1d20b26221e3ca4a36d2bb7d3b78ae2c590b.dll,#12⤵
- Blocklisted process makes network request
PID:1272
-