Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll
Resource
win10v2004-20221111-en
General
-
Target
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll
-
Size
236KB
-
MD5
afe0b2ada17dd7499175201529671b00
-
SHA1
e9180a0fc07ea9f5ace7503fa8291e779a60f1c0
-
SHA256
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8
-
SHA512
f7001f984aad669b5bf760c6e2e021e16d457a257e30824f2af6c47dd153adc3ebe1399a273d6e29883d24924565eedc494623a7976405f2639d8d2bb7cc4c23
-
SSDEEP
6144:eneA7poLiVy+w+X0u4zT1IwwrYvFGZ1FtxJUopxvn:enZ7poLsaw4z1GZ1HvUoz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll,#12⤵PID:840
-