Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll
Resource
win10v2004-20220812-en
General
-
Target
65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll
-
Size
72KB
-
MD5
0422af5e1d4f29423dbead49e76fd460
-
SHA1
a35a04089b3599844ccbf93afde418d453933887
-
SHA256
65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee
-
SHA512
86359b653c9e47e2d5b5d47c8e10086db8a1fe0f70b09ac101d92ea317e02b70bebeec7a86e3ee3e9584718d448a49a7758a85e05a8e68fc139a72b4376f7452
-
SSDEEP
768:9doYItUVp4TbQcthznmqfUyML/iAPeQjmhILuaGF8AHpkSqTps:9doXtUETRUBP9uBtHFqTq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1388 2028 rundll32.exe 27 PID 2028 wrote to memory of 1388 2028 rundll32.exe 27 PID 2028 wrote to memory of 1388 2028 rundll32.exe 27 PID 2028 wrote to memory of 1388 2028 rundll32.exe 27 PID 2028 wrote to memory of 1388 2028 rundll32.exe 27 PID 2028 wrote to memory of 1388 2028 rundll32.exe 27 PID 2028 wrote to memory of 1388 2028 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll,#12⤵PID:1388
-