Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/10/2022, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll
Resource
win10v2004-20220901-en
General
-
Target
025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll
-
Size
9KB
-
MD5
6209ad1ec48ff1668d96737c826cd0e1
-
SHA1
ebfa1538cee07f0010bd9f17d23a8cb4bdc85bf9
-
SHA256
025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d
-
SHA512
9e149e62d5d14935260f3623cad2628d1c90a64892dce20bb5a4864f578c5c02a7fcccfef2a2dc0f0807d91b8a36a3d071a5eacf0e3699cabe047b9e30a8e273
-
SSDEEP
96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:wuwEt8rsTUtPLzKNWSYWF4b
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll,#12⤵PID:788
-