Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
86s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
c03724fed891f959e339579b29c575b5814389a19966b392692053efedd6a4ce.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c03724fed891f959e339579b29c575b5814389a19966b392692053efedd6a4ce.dll
Resource
win10v2004-20221111-en
General
-
Target
c03724fed891f959e339579b29c575b5814389a19966b392692053efedd6a4ce.dll
-
Size
296KB
-
MD5
69a6acfd9f34cb0ad71efc115235b979
-
SHA1
497fb806ec80acc35d2db2e9107580f793b028b3
-
SHA256
c03724fed891f959e339579b29c575b5814389a19966b392692053efedd6a4ce
-
SHA512
4f4387e1f8b033bf7b0f2ab7ad579fbdff28c8265ffc4e7e86c85ae580a2ca9656149b73d827e81521687120f6075f686d815094d6dc9b9397d854a8e457ecab
-
SSDEEP
6144:2ybfUSgoucqAh+QgF7vWum4UevP9thUq9SvIxXS:2ybMBN7uu5vPTh/9hNS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 952 wrote to memory of 1952 952 rundll32.exe 28 PID 952 wrote to memory of 1952 952 rundll32.exe 28 PID 952 wrote to memory of 1952 952 rundll32.exe 28 PID 952 wrote to memory of 1952 952 rundll32.exe 28 PID 952 wrote to memory of 1952 952 rundll32.exe 28 PID 952 wrote to memory of 1952 952 rundll32.exe 28 PID 952 wrote to memory of 1952 952 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c03724fed891f959e339579b29c575b5814389a19966b392692053efedd6a4ce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c03724fed891f959e339579b29c575b5814389a19966b392692053efedd6a4ce.dll,#12⤵PID:1952
-