Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
Resource
win10v2004-20220812-en
General
-
Target
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
-
Size
20KB
-
MD5
064ee2886b29169b78956133017c8736
-
SHA1
91c5c6e65356bd94c18e4ea540aa24d84f080d12
-
SHA256
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b
-
SHA512
ad3665d21a58c008ad78a853811afd2843db8c7c1b05ca336d74639073e86737845c17a5ccd2ded951a749215cddf7bd5bd4a274d240a4c2c08d14250fa4878d
-
SSDEEP
384:E8e/FlJnjG7mmpPdEizc1Tus9mViVaVBVqVd+Ve+VqVE1:UF3njE1biTutUcvYWts
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1076 1488 rundll32.exe 26 PID 1488 wrote to memory of 1076 1488 rundll32.exe 26 PID 1488 wrote to memory of 1076 1488 rundll32.exe 26 PID 1488 wrote to memory of 1076 1488 rundll32.exe 26 PID 1488 wrote to memory of 1076 1488 rundll32.exe 26 PID 1488 wrote to memory of 1076 1488 rundll32.exe 26 PID 1488 wrote to memory of 1076 1488 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#12⤵PID:1076
-