Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 20:18
Static task
static1
Behavioral task
behavioral1
Sample
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll
-
Size
47KB
-
MD5
46123c688f5062cd3d54ca5a3c41d8a0
-
SHA1
9fd699c948014d419ad3a3cb9c38b6c955fec89f
-
SHA256
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b
-
SHA512
40e0e1f5acb846ebec05113362cde37e9bba2f3cd31e4cd0b67a0a061803c64a06036ba71ed92132ce0f0eff62273c01e0f352c262310c151cf8a730ace250f8
-
SSDEEP
768:OXMl2iz3EdxQGFSxGkU10TDjHfZuw/bbKtEUk49FyAVX09IPXOoP:OXMkiz3EdxVFwGJ10TnHEAbbKtEUkiys
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1772 wrote to memory of 832 1772 rundll32.exe 28 PID 1772 wrote to memory of 832 1772 rundll32.exe 28 PID 1772 wrote to memory of 832 1772 rundll32.exe 28 PID 1772 wrote to memory of 832 1772 rundll32.exe 28 PID 1772 wrote to memory of 832 1772 rundll32.exe 28 PID 1772 wrote to memory of 832 1772 rundll32.exe 28 PID 1772 wrote to memory of 832 1772 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:832
-