Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
204s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
af48eaa4a89a8f530af794f1900c27451889a5adcef3bbe4e5d6ec9390314031.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af48eaa4a89a8f530af794f1900c27451889a5adcef3bbe4e5d6ec9390314031.dll
Resource
win10v2004-20220812-en
General
-
Target
af48eaa4a89a8f530af794f1900c27451889a5adcef3bbe4e5d6ec9390314031.dll
-
Size
1.7MB
-
MD5
a3b1cae98b3c829a5043cab462406e00
-
SHA1
14414e4c4d423c3540800121e3932ce1f16a7a47
-
SHA256
af48eaa4a89a8f530af794f1900c27451889a5adcef3bbe4e5d6ec9390314031
-
SHA512
d5a64273d9151924da834038f272dfd6bd28a135046b9c04e515cab5c25274ad242299636e54b08809ef55c1d2b73577c5b6b94ad225763f63cd46f3c4090e82
-
SSDEEP
49152:OsCYTax6GxwhXK2Ee7XPx7SsItfRCu1X2dJeTcxj:ptEE53Px+RV2XeTc9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1904 1948 rundll32.exe 27 PID 1948 wrote to memory of 1904 1948 rundll32.exe 27 PID 1948 wrote to memory of 1904 1948 rundll32.exe 27 PID 1948 wrote to memory of 1904 1948 rundll32.exe 27 PID 1948 wrote to memory of 1904 1948 rundll32.exe 27 PID 1948 wrote to memory of 1904 1948 rundll32.exe 27 PID 1948 wrote to memory of 1904 1948 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af48eaa4a89a8f530af794f1900c27451889a5adcef3bbe4e5d6ec9390314031.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af48eaa4a89a8f530af794f1900c27451889a5adcef3bbe4e5d6ec9390314031.dll,#12⤵PID:1904
-