Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 04:41
Static task
static1
Behavioral task
behavioral1
Sample
e3f5944661b42d87c9dc9f0b2a33e6ebcdf98fef4bb7e4d5d1e49d56425822e0.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e3f5944661b42d87c9dc9f0b2a33e6ebcdf98fef4bb7e4d5d1e49d56425822e0.dll
Resource
win10v2004-20221111-en
General
-
Target
e3f5944661b42d87c9dc9f0b2a33e6ebcdf98fef4bb7e4d5d1e49d56425822e0.dll
-
Size
259KB
-
MD5
3ee66f6d328f9b2b394c5610bb92962e
-
SHA1
016bdd54de7f0ff83f3ec29afe6ee7e7e62c7dcd
-
SHA256
e3f5944661b42d87c9dc9f0b2a33e6ebcdf98fef4bb7e4d5d1e49d56425822e0
-
SHA512
e6db438c219cf5f5d5dd1e8e3c229f2943202e45dae01362f69e3d35ea91c637efaa47725e6605c43e004310324e814b91f18533f7c799730ae0787b1c0f70af
-
SSDEEP
3072:VsIQKs2FcpRqeYxFkpIRxMx6pVJ8nEX7foggKy5HAHjNz:VsIQ2c7q9xFkAxMxEVJAi
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3f5944661b42d87c9dc9f0b2a33e6ebcdf98fef4bb7e4d5d1e49d56425822e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3f5944661b42d87c9dc9f0b2a33e6ebcdf98fef4bb7e4d5d1e49d56425822e0.dll,#12⤵PID:1172
-