Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll
Resource
win10v2004-20220812-en
General
-
Target
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll
-
Size
102KB
-
MD5
3983fe5a3da123b2fdf237908044b200
-
SHA1
2302ebd1ac8a30e5265ba1c06af20e6c31b3357d
-
SHA256
c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76
-
SHA512
891b526115ddc4a83822f18a91b00d9e4bc8781609e88774e6e791b474524b43fb8d8b9d95a31ea504cb66f6ccb93087bd1cee66284a2cd27c4e704d80b70742
-
SSDEEP
3072:KfEltY+UGznKyqoL0Rhx378GAjtN/CdwFR76Uzgr2s7c:YCaPybWxL1+era
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll,#12⤵PID:1808
-