Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
d7382e9c574f731e00216680c1f173fef7e99375f079b91a678571be2ee64756.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d7382e9c574f731e00216680c1f173fef7e99375f079b91a678571be2ee64756.dll
Resource
win10v2004-20220812-en
General
-
Target
d7382e9c574f731e00216680c1f173fef7e99375f079b91a678571be2ee64756.dll
-
Size
416KB
-
MD5
cbc4ed0374c8afe4199914b0ee11b180
-
SHA1
2ad911b15a3fce3b5f839e433118703939bc5763
-
SHA256
d7382e9c574f731e00216680c1f173fef7e99375f079b91a678571be2ee64756
-
SHA512
f1e82eb1f068499a4a396afc84ee847db8de5a11c86ee14cdb9eb53603bbad8b1f9183b0471d1a36434641c2b2d16974759d52f247e6cc2fac60e3b312cbb6bc
-
SSDEEP
6144:QdoSityBcrECwzKPmMOSF1ck5zIsbs9iQ0qkC:ghOa7Cwve1c4I38qkC
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1900 1460 rundll32.exe 28 PID 1460 wrote to memory of 1900 1460 rundll32.exe 28 PID 1460 wrote to memory of 1900 1460 rundll32.exe 28 PID 1460 wrote to memory of 1900 1460 rundll32.exe 28 PID 1460 wrote to memory of 1900 1460 rundll32.exe 28 PID 1460 wrote to memory of 1900 1460 rundll32.exe 28 PID 1460 wrote to memory of 1900 1460 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7382e9c574f731e00216680c1f173fef7e99375f079b91a678571be2ee64756.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7382e9c574f731e00216680c1f173fef7e99375f079b91a678571be2ee64756.dll,#12⤵PID:1900
-