Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 16:05
Static task
static1
Behavioral task
behavioral1
Sample
1460866624de8a584426c790527e29c22e88a67d6a0709e35bf93358e7db22b1.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1460866624de8a584426c790527e29c22e88a67d6a0709e35bf93358e7db22b1.dll
Resource
win10v2004-20220812-en
General
-
Target
1460866624de8a584426c790527e29c22e88a67d6a0709e35bf93358e7db22b1.dll
-
Size
9KB
-
MD5
a0b595d5a5556afd1228dd67941dd5f0
-
SHA1
e39a74ca538219c9b4b95038ee6927d6743ec175
-
SHA256
1460866624de8a584426c790527e29c22e88a67d6a0709e35bf93358e7db22b1
-
SHA512
b663565145fa6f8c3e1f982f366ac2dabb8bd2e558313f5b1b28591d04f779d560fc44723b32892342e0c9d677d8ffae8fab8d4c8cc4bb2703d740e4f6b18532
-
SSDEEP
192:XNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDNp0:d1mWEHI2oT7Nh9Dqv6qJtN70
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1288 1708 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 620 wrote to memory of 1708 620 rundll32.exe 27 PID 1708 wrote to memory of 1288 1708 rundll32.exe 28 PID 1708 wrote to memory of 1288 1708 rundll32.exe 28 PID 1708 wrote to memory of 1288 1708 rundll32.exe 28 PID 1708 wrote to memory of 1288 1708 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1460866624de8a584426c790527e29c22e88a67d6a0709e35bf93358e7db22b1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1460866624de8a584426c790527e29c22e88a67d6a0709e35bf93358e7db22b1.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2363⤵
- Program crash
PID:1288
-
-