Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14/10/2022, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
d95bc0b7e23645383b9e2d267e333d6d907512dfa6ac9a99ba848630b47a8c9f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d95bc0b7e23645383b9e2d267e333d6d907512dfa6ac9a99ba848630b47a8c9f.dll
Resource
win10v2004-20220812-en
General
-
Target
d95bc0b7e23645383b9e2d267e333d6d907512dfa6ac9a99ba848630b47a8c9f.dll
-
Size
17KB
-
MD5
9580f8dc7a4068c06737abe2369643a1
-
SHA1
a729bf34d40ef1bc01920e1f972169260c5715ed
-
SHA256
d95bc0b7e23645383b9e2d267e333d6d907512dfa6ac9a99ba848630b47a8c9f
-
SHA512
8770b06a216f83496672b11e4487ba0781645a91fc2bb2c116172afccc812708f34a5ab25f6e80ab7af6bb7ed122af4ecbf47e777095af096915658682b1716c
-
SSDEEP
192:nDqeRwdb3enG2RxnSGzTcb7dYMnW0TYxm2pXEz4JWaULI7kbSHkFQc3psZ/Q99gs:DqzdeGQ/TcFPnW0wp0tekWo5s5eGZvXS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1592 wrote to memory of 1964 1592 rundll32.exe 27 PID 1592 wrote to memory of 1964 1592 rundll32.exe 27 PID 1592 wrote to memory of 1964 1592 rundll32.exe 27 PID 1592 wrote to memory of 1964 1592 rundll32.exe 27 PID 1592 wrote to memory of 1964 1592 rundll32.exe 27 PID 1592 wrote to memory of 1964 1592 rundll32.exe 27 PID 1592 wrote to memory of 1964 1592 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d95bc0b7e23645383b9e2d267e333d6d907512dfa6ac9a99ba848630b47a8c9f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d95bc0b7e23645383b9e2d267e333d6d907512dfa6ac9a99ba848630b47a8c9f.dll,#12⤵PID:1964
-