Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll
-
Size
40KB
-
MD5
04eb8c4b042211d7b4cbd053a1c9c480
-
SHA1
70922d865ff95141b287d94bf41933ed58c59b12
-
SHA256
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454
-
SHA512
06ea126edf4eb160503ef0f0de606c1316cc0fd16b0da34ea63e51b51647f0feb7c02a6cdcc665b9d242717857a94d51815edc97c2be3bf618de1aac824fc1b1
-
SSDEEP
768:H+ZRMl2iz3EdxQGFSxGkT2m3Ta0VNaopWNLwTDQVbDaIgstH+:eZRMkiz3EdxVFwGG2m3TZuopWNLwTMek
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 968 wrote to memory of 1904 968 rundll32.exe 28 PID 968 wrote to memory of 1904 968 rundll32.exe 28 PID 968 wrote to memory of 1904 968 rundll32.exe 28 PID 968 wrote to memory of 1904 968 rundll32.exe 28 PID 968 wrote to memory of 1904 968 rundll32.exe 28 PID 968 wrote to memory of 1904 968 rundll32.exe 28 PID 968 wrote to memory of 1904 968 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904
-