Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
f76c14f4f6dc57506c76d3cd3366e99523d4eeaffc4ded631720efb1ca10e5b3.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f76c14f4f6dc57506c76d3cd3366e99523d4eeaffc4ded631720efb1ca10e5b3.dll
Resource
win10v2004-20221111-en
General
-
Target
f76c14f4f6dc57506c76d3cd3366e99523d4eeaffc4ded631720efb1ca10e5b3.dll
-
Size
324KB
-
MD5
28e3daa0acf8482004e33431c45350a8
-
SHA1
db40bcaf7ebd66febee4088138ddb646d73beb8f
-
SHA256
f76c14f4f6dc57506c76d3cd3366e99523d4eeaffc4ded631720efb1ca10e5b3
-
SHA512
b15dead8c89d0ce2488088840a412be0ac8c7ddcf5d6cadf5635c710ac7849fd9296603f7259a5cb268de96dc651b24168a133dc3a08633f80a7b1ab75681520
-
SSDEEP
6144:HAAiXXHcpcBXRBO6oiZyiNyfgSspambVkiWmOsQB+Bc2lf:HlQXHbjkbigib5pDbVkvNB+Bc2lf
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26 PID 1376 wrote to memory of 840 1376 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f76c14f4f6dc57506c76d3cd3366e99523d4eeaffc4ded631720efb1ca10e5b3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f76c14f4f6dc57506c76d3cd3366e99523d4eeaffc4ded631720efb1ca10e5b3.dll,#12⤵PID:840
-