Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
37s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 01:01
Behavioral task
behavioral1
Sample
12a578d5a3652c95ca21f1e780b12781a2319e4dffa0b71f6d3f80ea84677887.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
12a578d5a3652c95ca21f1e780b12781a2319e4dffa0b71f6d3f80ea84677887.dll
Resource
win10v2004-20221111-en
General
-
Target
12a578d5a3652c95ca21f1e780b12781a2319e4dffa0b71f6d3f80ea84677887.dll
-
Size
67KB
-
MD5
0314eb954a2e8b99518ef62c309e535b
-
SHA1
66b5b889dcf5cf6a63631b70845f1c9695504af3
-
SHA256
12a578d5a3652c95ca21f1e780b12781a2319e4dffa0b71f6d3f80ea84677887
-
SHA512
4f2fec955e008490ea27d4c34728d617cd9d01ddc536e88847c11a56912d8303c4c4595b84ee86db307936bbb0b8c55d9393fc2acdef3dc30175d1e6ccd953ef
-
SSDEEP
1536:7nrxDussGn4AAejPC7Mp/c+HJgKKWz3p/wBBwQ:D6tV0pk+pg6t/EKQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12a578d5a3652c95ca21f1e780b12781a2319e4dffa0b71f6d3f80ea84677887.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12a578d5a3652c95ca21f1e780b12781a2319e4dffa0b71f6d3f80ea84677887.dll,#12⤵PID:1980
-