Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 06:27
Behavioral task
behavioral1
Sample
4991bb3fddcaae5993cd6b2e8bc25b6226394e4b266513490c09ca85a12265a8.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4991bb3fddcaae5993cd6b2e8bc25b6226394e4b266513490c09ca85a12265a8.dll
Resource
win10v2004-20220812-en
General
-
Target
4991bb3fddcaae5993cd6b2e8bc25b6226394e4b266513490c09ca85a12265a8.dll
-
Size
103KB
-
MD5
80015d510d66465ce87b8bb1e9a9ed09
-
SHA1
6338e1c2255e55eacb0e74acaec54ac463b2a780
-
SHA256
4991bb3fddcaae5993cd6b2e8bc25b6226394e4b266513490c09ca85a12265a8
-
SHA512
1d108041dd2fb7a3878c144c34b96815a39f0193d14a26fd711038dd89ab83a70cdac1adb2e7ea7449371fb62ed7acb717cb8cd9960467eea6f44a0a2d0c195e
-
SSDEEP
3072:f2RWdNEp4Ls2ADWmxQft2dLiRMQ9r39LvCZd:f2RWdNEqg9DW57RMQ9r39L6Zd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1948 1444 rundll32.exe 27 PID 1444 wrote to memory of 1948 1444 rundll32.exe 27 PID 1444 wrote to memory of 1948 1444 rundll32.exe 27 PID 1444 wrote to memory of 1948 1444 rundll32.exe 27 PID 1444 wrote to memory of 1948 1444 rundll32.exe 27 PID 1444 wrote to memory of 1948 1444 rundll32.exe 27 PID 1444 wrote to memory of 1948 1444 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4991bb3fddcaae5993cd6b2e8bc25b6226394e4b266513490c09ca85a12265a8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4991bb3fddcaae5993cd6b2e8bc25b6226394e4b266513490c09ca85a12265a8.dll,#12⤵PID:1948
-