Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
0b84e560861f74c7a8c8fac7ee13dbefe023a50ea4619fb95b1ac578401c229d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b84e560861f74c7a8c8fac7ee13dbefe023a50ea4619fb95b1ac578401c229d.dll
Resource
win10v2004-20221111-en
General
-
Target
0b84e560861f74c7a8c8fac7ee13dbefe023a50ea4619fb95b1ac578401c229d.dll
-
Size
156KB
-
MD5
85c895746117ddd1cb6dc17b3bb148d0
-
SHA1
49ef0e383cdf6242f91f5f81895ac78adcf7ea73
-
SHA256
0b84e560861f74c7a8c8fac7ee13dbefe023a50ea4619fb95b1ac578401c229d
-
SHA512
b56d938a00601f67c7325f28cb069610934ae4dff13b5c89d49d4dc5f2a684bf5dba908bb5a267f8b0c6dba801ddb8bfb76cfa023bddd0caa7147507ee7ee408
-
SSDEEP
3072:06bm/SIyleFtOBUe5rOE8AYOtPSoZ/V0WApcHf7F:aSIylwWrr8AYOtR0WB
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b84e560861f74c7a8c8fac7ee13dbefe023a50ea4619fb95b1ac578401c229d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b84e560861f74c7a8c8fac7ee13dbefe023a50ea4619fb95b1ac578401c229d.dll,#12⤵PID:1460
-