Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 18:34
Static task
static1
Behavioral task
behavioral1
Sample
ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll
Resource
win10v2004-20220812-en
General
-
Target
ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll
-
Size
5KB
-
MD5
074441de2ca21471ace199a60c0eeeaa
-
SHA1
e76c68595d0ce814e94533784fd2c486a407f87e
-
SHA256
ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955
-
SHA512
f6371d38745d736ffb08c1921210c260e10ad20149ee9dec66a48769671820d69246b1697767ef5a2b8132a3c9bd4376db1eb1de2623484e6b06caa4d78a293a
-
SSDEEP
96:qT+ZKXI71G6Ezj1fzVbMIsv28nM5Y14pmWH1:qKkaGnxVbMIWnD14pnH1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1968 2020 rundll32.exe 28 PID 2020 wrote to memory of 1968 2020 rundll32.exe 28 PID 2020 wrote to memory of 1968 2020 rundll32.exe 28 PID 2020 wrote to memory of 1968 2020 rundll32.exe 28 PID 2020 wrote to memory of 1968 2020 rundll32.exe 28 PID 2020 wrote to memory of 1968 2020 rundll32.exe 28 PID 2020 wrote to memory of 1968 2020 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll,#12⤵PID:1968
-