Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
05d42094f8fdfd53f1d2360e5e1d8003b71f51481212bf03325677dff605e276.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
05d42094f8fdfd53f1d2360e5e1d8003b71f51481212bf03325677dff605e276.dll
Resource
win10v2004-20220812-en
General
-
Target
05d42094f8fdfd53f1d2360e5e1d8003b71f51481212bf03325677dff605e276.dll
-
Size
152KB
-
MD5
330d2283938c251fe80f9ea6f42f3240
-
SHA1
ff8ae2b0bca29cecd44c51cc7b6b5a3cd2f3eea7
-
SHA256
05d42094f8fdfd53f1d2360e5e1d8003b71f51481212bf03325677dff605e276
-
SHA512
491d1ec14e6738f1db13c88a5afebc50c136f94781291b36dc86dba5dd40e34b9ef2fdee8a666f62676acf383789f7503315d60795b7604a425aeb4e336ddb80
-
SSDEEP
1536:gicIfMI7IjkuvfZ/AuwdcLN3KybbUm8odCwPXkdrNYVWmCcno7GBTAcsqd1Pfb:ghfU8xvfGdo3KAFgdrNYVWfcPAsX
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05d42094f8fdfd53f1d2360e5e1d8003b71f51481212bf03325677dff605e276.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05d42094f8fdfd53f1d2360e5e1d8003b71f51481212bf03325677dff605e276.dll,#12⤵PID:1168
-