Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    10s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 19:59

General

  • Target

    b95b0d220097d627dfa09aaafae743e848b3c3ffd7270a49f4b70d9e2c574bf6.dll

  • Size

    578KB

  • MD5

    df41431ea5bd3fdc9aaefbebb81afaea

  • SHA1

    71fc690ab5f32ac9e842bff7e935bdada94e0007

  • SHA256

    b95b0d220097d627dfa09aaafae743e848b3c3ffd7270a49f4b70d9e2c574bf6

  • SHA512

    d2b7c10456284e175080788e5aedb87715feb33f677e04e0ddde757e5495a9bf6be12c50d4c5b2ef2ff566f05efc8cce1452953a892c28d95a7a6a70a5f64de6

  • SSDEEP

    12288:N/YxKQQNBVUSfr5D3OHUHiF3Z4mxx1DqVTVOC6hQ:ixKQQnVDdbNHiQmXEVTz6S

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95b0d220097d627dfa09aaafae743e848b3c3ffd7270a49f4b70d9e2c574bf6.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95b0d220097d627dfa09aaafae743e848b3c3ffd7270a49f4b70d9e2c574bf6.dll,#1
      2⤵
        PID:1352

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1352-55-0x0000000075091000-0x0000000075093000-memory.dmp

      Filesize

      8KB

    • memory/1352-56-0x0000000000830000-0x0000000000913000-memory.dmp

      Filesize

      908KB

    • memory/1352-57-0x0000000000830000-0x00000000008F1000-memory.dmp

      Filesize

      772KB