Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 05:00
Behavioral task
behavioral1
Sample
4bfc5dd9043a1bfab9b3124569cdf7b1fd62cd7ee439b9ac3606078741e6bd09.dll
Resource
win7-20220812-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4bfc5dd9043a1bfab9b3124569cdf7b1fd62cd7ee439b9ac3606078741e6bd09.dll
Resource
win10v2004-20220812-en
3 signatures
150 seconds
General
-
Target
4bfc5dd9043a1bfab9b3124569cdf7b1fd62cd7ee439b9ac3606078741e6bd09.dll
-
Size
3KB
-
MD5
90315a0a16c397013bfb0f806531e4d0
-
SHA1
5f2f30f2d01a7c251a914f71b9b8284771d822f8
-
SHA256
4bfc5dd9043a1bfab9b3124569cdf7b1fd62cd7ee439b9ac3606078741e6bd09
-
SHA512
64cb265326492074572c14243aadbb9b394f7978808d6380d4d0be5c36baba1d9ce22a5af9dce022bab890fdcaba638c006de33b8c76b3489ad49fec2d491b49
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/memory/892-57-0x0000000074790000-0x0000000074798000-memory.dmp acprotect behavioral1/memory/892-58-0x0000000074790000-0x0000000074798000-memory.dmp acprotect -
resource yara_rule behavioral1/memory/892-57-0x0000000074790000-0x0000000074798000-memory.dmp upx behavioral1/memory/892-58-0x0000000074790000-0x0000000074798000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 552 wrote to memory of 892 552 rundll32.exe 27 PID 552 wrote to memory of 892 552 rundll32.exe 27 PID 552 wrote to memory of 892 552 rundll32.exe 27 PID 552 wrote to memory of 892 552 rundll32.exe 27 PID 552 wrote to memory of 892 552 rundll32.exe 27 PID 552 wrote to memory of 892 552 rundll32.exe 27 PID 552 wrote to memory of 892 552 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfc5dd9043a1bfab9b3124569cdf7b1fd62cd7ee439b9ac3606078741e6bd09.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfc5dd9043a1bfab9b3124569cdf7b1fd62cd7ee439b9ac3606078741e6bd09.dll,#12⤵PID:892
-