Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
55011df876d2200ea47a00ebf811dbdacdd9cd8168c9d1b5718e420ef655c7ec.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
55011df876d2200ea47a00ebf811dbdacdd9cd8168c9d1b5718e420ef655c7ec.dll
Resource
win10v2004-20220901-en
General
-
Target
55011df876d2200ea47a00ebf811dbdacdd9cd8168c9d1b5718e420ef655c7ec.dll
-
Size
56KB
-
MD5
2f011e3663f722508c1ddb9d77197d80
-
SHA1
0e44761c81184cb61380e39bd0664a86d00ef1f7
-
SHA256
55011df876d2200ea47a00ebf811dbdacdd9cd8168c9d1b5718e420ef655c7ec
-
SHA512
911952785e43368a5d355f7c7ecd5932b55b128ce4e831b14f1c05ac34c757fd2956e77dac8591abf95d7c95bb231e2ebcfe2d12c23058b815b2f248a0f93e75
-
SSDEEP
768:o6H3XTYIstsIxUNNtYr8YDTQi6r5GLYCz9CRenchlirazmwhh:NH3XMIstXxUuDTQi6NGFB5Mliu6K
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1720 wrote to memory of 804 1720 rundll32.exe 28 PID 1720 wrote to memory of 804 1720 rundll32.exe 28 PID 1720 wrote to memory of 804 1720 rundll32.exe 28 PID 1720 wrote to memory of 804 1720 rundll32.exe 28 PID 1720 wrote to memory of 804 1720 rundll32.exe 28 PID 1720 wrote to memory of 804 1720 rundll32.exe 28 PID 1720 wrote to memory of 804 1720 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55011df876d2200ea47a00ebf811dbdacdd9cd8168c9d1b5718e420ef655c7ec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55011df876d2200ea47a00ebf811dbdacdd9cd8168c9d1b5718e420ef655c7ec.dll,#12⤵PID:804
-