Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
9dc6abc63882be1bc0cb65c57d0067e5003b6cf1c20fb23598f289897e463621.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
9dc6abc63882be1bc0cb65c57d0067e5003b6cf1c20fb23598f289897e463621.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
9dc6abc63882be1bc0cb65c57d0067e5003b6cf1c20fb23598f289897e463621.dll
-
Size
704KB
-
MD5
7ce6e3ee347311edb5b6263440e0cc31
-
SHA1
8b6034a55dbbcab94879615267ab1e36d2c36a35
-
SHA256
9dc6abc63882be1bc0cb65c57d0067e5003b6cf1c20fb23598f289897e463621
-
SHA512
ecda8c637e31053d4fa6bc1d12944a5cca128e9438b676efae9f97b95729298804aaa60905f9594b7ab49c4b17663a508ce42d55487b226905dd01085e651ca7
-
SSDEEP
12288:/LQjv41vQ7SC/0ueRL1VTGe87ZyBYyamM5lNwSJUtuGKYNTT:Ur4J3Pu6LbTv87ZKYdNwSJUtbTT
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 884 wrote to memory of 1992 884 rundll32.exe 27 PID 884 wrote to memory of 1992 884 rundll32.exe 27 PID 884 wrote to memory of 1992 884 rundll32.exe 27 PID 884 wrote to memory of 1992 884 rundll32.exe 27 PID 884 wrote to memory of 1992 884 rundll32.exe 27 PID 884 wrote to memory of 1992 884 rundll32.exe 27 PID 884 wrote to memory of 1992 884 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dc6abc63882be1bc0cb65c57d0067e5003b6cf1c20fb23598f289897e463621.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dc6abc63882be1bc0cb65c57d0067e5003b6cf1c20fb23598f289897e463621.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:1992
-