Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll
Resource
win7-20221111-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll
-
Size
3KB
-
MD5
16f30c08ea3fff793e6467f3997616b0
-
SHA1
9bb1946f59ccb503d1a0951b3dfb51246375a8d6
-
SHA256
21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549
-
SHA512
172290383a3256bc2d4cb534cd37ae54a3f29feadd30296d133e19a5b00d9e0c0683e546b36f83f4cabfc271fd56e285a7d3b54156e89845951af0225acf041b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1224 1120 rundll32.exe 28 PID 1120 wrote to memory of 1224 1120 rundll32.exe 28 PID 1120 wrote to memory of 1224 1120 rundll32.exe 28 PID 1120 wrote to memory of 1224 1120 rundll32.exe 28 PID 1120 wrote to memory of 1224 1120 rundll32.exe 28 PID 1120 wrote to memory of 1224 1120 rundll32.exe 28 PID 1120 wrote to memory of 1224 1120 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll,#12⤵PID:1224
-