Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll
Resource
win10v2004-20221111-en
General
-
Target
9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll
-
Size
148KB
-
MD5
d6f58392fb63fe33b12ccdcc2c734646
-
SHA1
e7f75ad0bdf3edb534d0a9674896901253840b96
-
SHA256
9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb
-
SHA512
c93676c4add7bbb53f4d8419cff5613db5ef56c3c9cac1f78827f066adc1dc625635dfcd40c92ced97cdb1f0a8ec1e9260621060b042672fa619d16c9e92832f
-
SSDEEP
3072:uNa3mOoUpyUNTbR9/oPW6sRSo4WMy6GoOIO:uE3nhUUvpeyn
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26 PID 1584 wrote to memory of 1172 1584 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll,#12⤵PID:1172
-