Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll
Resource
win10v2004-20220812-en
General
-
Target
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll
-
Size
124KB
-
MD5
df543a4f96291a530169ee3e6195e480
-
SHA1
98d10f992b92e63adacca0f31a8888218055714f
-
SHA256
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b
-
SHA512
1a42bfbd85405251a4dd820633b336a2e26247f17851ea1afd32cff53d6824495e8da32edde815a9b0c2621da27ee46d2f925f2dc8c956205e3b7b8dc409a03d
-
SSDEEP
3072:zIVW/iFVbQhRDB5ollrQsAdmYKyYJpoFYdS:qWqXbAt5EllAw0
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1300 1720 rundll32.exe 27 PID 1720 wrote to memory of 1300 1720 rundll32.exe 27 PID 1720 wrote to memory of 1300 1720 rundll32.exe 27 PID 1720 wrote to memory of 1300 1720 rundll32.exe 27 PID 1720 wrote to memory of 1300 1720 rundll32.exe 27 PID 1720 wrote to memory of 1300 1720 rundll32.exe 27 PID 1720 wrote to memory of 1300 1720 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll,#12⤵PID:1300
-