Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 05:08
Behavioral task
behavioral1
Sample
20c076ca6ddbe0e04b15d3853508855f0cf62bf87449b8aab8d21138a3a11683.dll
Resource
win7-20221111-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
20c076ca6ddbe0e04b15d3853508855f0cf62bf87449b8aab8d21138a3a11683.dll
Resource
win10v2004-20220901-en
3 signatures
150 seconds
General
-
Target
20c076ca6ddbe0e04b15d3853508855f0cf62bf87449b8aab8d21138a3a11683.dll
-
Size
3KB
-
MD5
e8d82242cd3324ef177223bb3e50a460
-
SHA1
d34d1e7015c65e994ebd68e9d9f2466d6ed94916
-
SHA256
20c076ca6ddbe0e04b15d3853508855f0cf62bf87449b8aab8d21138a3a11683
-
SHA512
632292120546466491e5b013be88a07315cd3d326fa919d21e5ebd647c6426d4b6aa7b0aeae19e8934deb22ac1e3c8c90e9712fb602d0b8b497aa3c6ab03eafa
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/memory/1408-57-0x00000000751E0000-0x00000000751E8000-memory.dmp acprotect -
resource yara_rule behavioral1/memory/1408-57-0x00000000751E0000-0x00000000751E8000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1408 1460 rundll32.exe 28 PID 1460 wrote to memory of 1408 1460 rundll32.exe 28 PID 1460 wrote to memory of 1408 1460 rundll32.exe 28 PID 1460 wrote to memory of 1408 1460 rundll32.exe 28 PID 1460 wrote to memory of 1408 1460 rundll32.exe 28 PID 1460 wrote to memory of 1408 1460 rundll32.exe 28 PID 1460 wrote to memory of 1408 1460 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\20c076ca6ddbe0e04b15d3853508855f0cf62bf87449b8aab8d21138a3a11683.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\20c076ca6ddbe0e04b15d3853508855f0cf62bf87449b8aab8d21138a3a11683.dll,#12⤵PID:1408
-