Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 01:48
Behavioral task
behavioral1
Sample
0f0d48680498cfe9600ae0f1e1d5981b019d7b707dcf85c179d27092f9eb4e08.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0f0d48680498cfe9600ae0f1e1d5981b019d7b707dcf85c179d27092f9eb4e08.dll
Resource
win10v2004-20220812-en
General
-
Target
0f0d48680498cfe9600ae0f1e1d5981b019d7b707dcf85c179d27092f9eb4e08.dll
-
Size
277KB
-
MD5
0fe6400a34f8699d0c5976c6751fea80
-
SHA1
4c97303fb0f1ebe067e18a33fe859746a500ac52
-
SHA256
0f0d48680498cfe9600ae0f1e1d5981b019d7b707dcf85c179d27092f9eb4e08
-
SHA512
97f6fbb945d3ec0e1501f60a908801f1094d91c4cd0c388afa6187a3b740105bdfe5dc9c69a3998e24df88017ccf2c760c4eec52937a539e0e7f5e6cba7d3088
-
SSDEEP
6144:swNPX3PnKbvwcSuHOZMhOtxKn8V6wXJLA48oLiYRNQt/+Rm4soSZu:swPX3/KbvweuOhsJFlT82RIE84soS0
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1296-56-0x0000000010000000-0x00000000100A3000-memory.dmp upx behavioral1/memory/1296-57-0x0000000010000000-0x00000000100A3000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1560 wrote to memory of 1296 1560 rundll32.exe 28 PID 1560 wrote to memory of 1296 1560 rundll32.exe 28 PID 1560 wrote to memory of 1296 1560 rundll32.exe 28 PID 1560 wrote to memory of 1296 1560 rundll32.exe 28 PID 1560 wrote to memory of 1296 1560 rundll32.exe 28 PID 1560 wrote to memory of 1296 1560 rundll32.exe 28 PID 1560 wrote to memory of 1296 1560 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0d48680498cfe9600ae0f1e1d5981b019d7b707dcf85c179d27092f9eb4e08.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0d48680498cfe9600ae0f1e1d5981b019d7b707dcf85c179d27092f9eb4e08.dll,#12⤵PID:1296
-