Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
72eafedd5210ca0b47eb86744221362af6aa494398ebdf27c2f7cbb8b3ed9577.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
72eafedd5210ca0b47eb86744221362af6aa494398ebdf27c2f7cbb8b3ed9577.dll
Resource
win10v2004-20220812-en
General
-
Target
72eafedd5210ca0b47eb86744221362af6aa494398ebdf27c2f7cbb8b3ed9577.dll
-
Size
8KB
-
MD5
fbb3bf445a844d294ebab89b78764340
-
SHA1
459700ba2495065d338fe5fd5b68b296cf6ca768
-
SHA256
72eafedd5210ca0b47eb86744221362af6aa494398ebdf27c2f7cbb8b3ed9577
-
SHA512
d55b564db1ef62008ad3acf9e86b225874768742d37f9532434d56eb535c3b4af654ade3b5d318ffcc1783a2a63ce6e63819302db4f9a9d098d67bf79f2a3e60
-
SSDEEP
96:1h9jTqMMrY0OI/KYyznSMK5I9SfdDCn0L2F3vs2ntqFoik9pii+3LtoZM6:t+MQyzned+nrFjZrr+y
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1392 1628 rundll32.exe 28 PID 1628 wrote to memory of 1392 1628 rundll32.exe 28 PID 1628 wrote to memory of 1392 1628 rundll32.exe 28 PID 1628 wrote to memory of 1392 1628 rundll32.exe 28 PID 1628 wrote to memory of 1392 1628 rundll32.exe 28 PID 1628 wrote to memory of 1392 1628 rundll32.exe 28 PID 1628 wrote to memory of 1392 1628 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72eafedd5210ca0b47eb86744221362af6aa494398ebdf27c2f7cbb8b3ed9577.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72eafedd5210ca0b47eb86744221362af6aa494398ebdf27c2f7cbb8b3ed9577.dll,#12⤵PID:1392
-