Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll
-
Size
3KB
-
MD5
a02ed269b3b0c8ef4d725e2925be739f
-
SHA1
db1de0d7fece42e0e153e3c3a65baefad7e5b192
-
SHA256
c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232
-
SHA512
663d998f105e741876db6424a2fec56fdf9bd7ef847a29456ddd7c5fcabfb8cfc87ba021161706dc317c4389642ded36e0b24c7e6a0a52662f29826fff2fc264
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1488 1632 rundll32.exe 27 PID 1632 wrote to memory of 1488 1632 rundll32.exe 27 PID 1632 wrote to memory of 1488 1632 rundll32.exe 27 PID 1632 wrote to memory of 1488 1632 rundll32.exe 27 PID 1632 wrote to memory of 1488 1632 rundll32.exe 27 PID 1632 wrote to memory of 1488 1632 rundll32.exe 27 PID 1632 wrote to memory of 1488 1632 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll,#12⤵PID:1488
-