Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll
Resource
win10v2004-20221111-en
General
-
Target
864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll
-
Size
33KB
-
MD5
9efd3fd52f20833b9278d5e1bac96a5a
-
SHA1
4c56b1cad516e4965e076ebcd1c6851a38fedaf2
-
SHA256
864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb
-
SHA512
d132e4dee2dc7a3d23bd1a0dbec6407a19d2c4cccc8d027280f1a7fc12377fac58910b7d77b849454abf3f471a99586dad81c5e40d52fdd7884f20c8a830d47f
-
SSDEEP
768:iAdVo1OwNMZi9LIj5u0hvVqYgr0ziY9m570vi:iAd8OQMAGnvWY9m10vi
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1068 2032 rundll32.exe 27 PID 2032 wrote to memory of 1068 2032 rundll32.exe 27 PID 2032 wrote to memory of 1068 2032 rundll32.exe 27 PID 2032 wrote to memory of 1068 2032 rundll32.exe 27 PID 2032 wrote to memory of 1068 2032 rundll32.exe 27 PID 2032 wrote to memory of 1068 2032 rundll32.exe 27 PID 2032 wrote to memory of 1068 2032 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\864c6dbddb0f27eaec629c45d2cb5bee1a3d19666b576989b134e31a54411abb.dll,#12⤵PID:1068
-