Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 16:52

General

  • Target

    1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1.dll

  • Size

    86KB

  • MD5

    a1b34174f23a34cf566ce04af21c41d8

  • SHA1

    fd13b6a459fc9a0cc20b2325bda1dc6c1f9aa3d7

  • SHA256

    1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1

  • SHA512

    f16230c7916992069eed8485a941260e665af17bcc3dc6364b47d795a9d61fad085de6dd6e6713976da3ba8b6368d3e165fcba09463b703054b957adbc83f1cc

  • SSDEEP

    1536:LXG9fNocyBzUWTb1YZ/k7RFAQiKkjTgQC4GArDl84VnV7HEhV5RYt6rN:AK3zU8s/k7NiviL0DlJVjao+

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfaaffbc76afe0df1fdfe910b34c67dde8d792b8e4c8ceb7a04533cf2a573e1.dll,#1
      2⤵
        PID:1524

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1524-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

      Filesize

      8KB