Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 22:26
Behavioral task
behavioral1
Sample
93ea2094926649e4f568af0abd717a6152788b742487dd35cfbdc3220de196c2.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
93ea2094926649e4f568af0abd717a6152788b742487dd35cfbdc3220de196c2.dll
Resource
win10v2004-20220812-en
General
-
Target
93ea2094926649e4f568af0abd717a6152788b742487dd35cfbdc3220de196c2.dll
-
Size
67KB
-
MD5
0029ce2b4e7e4fc1d19865f89f689360
-
SHA1
9e97e74f012b645f3cfecdac284b754ee78ad183
-
SHA256
93ea2094926649e4f568af0abd717a6152788b742487dd35cfbdc3220de196c2
-
SHA512
68094c5b4f9bf8fdbb3fddd29b2dafa1cdda43f24b57fdaae4bf3d02961d1ffb6707cf73ffa4990a5a49def79351f41cfb317b5d0563676d8e3017bf0c52e216
-
SSDEEP
1536:8nrxDussGn4AAejPC7Mp/c+HJgKKtLhVuDvRP0:y6tV0pk+pgRLPuD50
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1396 1600 rundll32.exe 27 PID 1600 wrote to memory of 1396 1600 rundll32.exe 27 PID 1600 wrote to memory of 1396 1600 rundll32.exe 27 PID 1600 wrote to memory of 1396 1600 rundll32.exe 27 PID 1600 wrote to memory of 1396 1600 rundll32.exe 27 PID 1600 wrote to memory of 1396 1600 rundll32.exe 27 PID 1600 wrote to memory of 1396 1600 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93ea2094926649e4f568af0abd717a6152788b742487dd35cfbdc3220de196c2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93ea2094926649e4f568af0abd717a6152788b742487dd35cfbdc3220de196c2.dll,#12⤵PID:1396
-