Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
235s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
352ab3e767d0e6a59ec04441115386b80508e80e5a5113ff3528ce75aa0e0e24.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
352ab3e767d0e6a59ec04441115386b80508e80e5a5113ff3528ce75aa0e0e24.dll
Resource
win10v2004-20220812-en
General
-
Target
352ab3e767d0e6a59ec04441115386b80508e80e5a5113ff3528ce75aa0e0e24.dll
-
Size
5KB
-
MD5
869b1b15e726071fb2872191ff222710
-
SHA1
16ce5185e71ce9f69fcad8925bf07c56fbb1361e
-
SHA256
352ab3e767d0e6a59ec04441115386b80508e80e5a5113ff3528ce75aa0e0e24
-
SHA512
ab585050221536bd3b85ea64a12960aabc82753fa0095faece808b953f41d7609389c3cf7b30d042356f20d5c07cc315503e3b7122a824250b09f788f65e885d
-
SSDEEP
48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXr+5Z:1h9jTqMMrY0OI/KYyznSMy
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1120 wrote to memory of 268 1120 rundll32.exe 28 PID 1120 wrote to memory of 268 1120 rundll32.exe 28 PID 1120 wrote to memory of 268 1120 rundll32.exe 28 PID 1120 wrote to memory of 268 1120 rundll32.exe 28 PID 1120 wrote to memory of 268 1120 rundll32.exe 28 PID 1120 wrote to memory of 268 1120 rundll32.exe 28 PID 1120 wrote to memory of 268 1120 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\352ab3e767d0e6a59ec04441115386b80508e80e5a5113ff3528ce75aa0e0e24.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\352ab3e767d0e6a59ec04441115386b80508e80e5a5113ff3528ce75aa0e0e24.dll,#12⤵PID:268
-