Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 09:44
Behavioral task
behavioral1
Sample
1b9cd8aeaf95e6ac8e068f8a740f86f9a40d9cc749957086e725b21d5f76af8d.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1b9cd8aeaf95e6ac8e068f8a740f86f9a40d9cc749957086e725b21d5f76af8d.dll
Resource
win10v2004-20220812-en
General
-
Target
1b9cd8aeaf95e6ac8e068f8a740f86f9a40d9cc749957086e725b21d5f76af8d.dll
-
Size
67KB
-
MD5
17b0e376a6f7e82372337ff829857551
-
SHA1
d6154b829a421d0e2209dd2014db0e91f788ff1f
-
SHA256
1b9cd8aeaf95e6ac8e068f8a740f86f9a40d9cc749957086e725b21d5f76af8d
-
SHA512
de0906d0ceab77f9bc37b1a57c37b4467748e30ae46290e3be380eff22d8a6e1230ceb2c2faa1affc36fb27b0f52c55af10a2ed685006b3031e4e9aa0a08f81e
-
SSDEEP
1536:7nrxDussGn4AAejPC7Mp/c+HJgKKWz3p/wBBws:D6tV0pk+pg6t/EKs
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1128 2032 rundll32.exe 26 PID 2032 wrote to memory of 1128 2032 rundll32.exe 26 PID 2032 wrote to memory of 1128 2032 rundll32.exe 26 PID 2032 wrote to memory of 1128 2032 rundll32.exe 26 PID 2032 wrote to memory of 1128 2032 rundll32.exe 26 PID 2032 wrote to memory of 1128 2032 rundll32.exe 26 PID 2032 wrote to memory of 1128 2032 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b9cd8aeaf95e6ac8e068f8a740f86f9a40d9cc749957086e725b21d5f76af8d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b9cd8aeaf95e6ac8e068f8a740f86f9a40d9cc749957086e725b21d5f76af8d.dll,#12⤵PID:1128
-