Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
9c143a9fa4c4a8cc8b587b1c6c260f3271584cbdf627138d019416cadc3205b4.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9c143a9fa4c4a8cc8b587b1c6c260f3271584cbdf627138d019416cadc3205b4.dll
Resource
win10v2004-20221111-en
General
-
Target
9c143a9fa4c4a8cc8b587b1c6c260f3271584cbdf627138d019416cadc3205b4.dll
-
Size
132KB
-
MD5
3972dc88fe737820d76ce340c27f0b51
-
SHA1
76eadaf974f905cdc78fb9b31285d0444690cdce
-
SHA256
9c143a9fa4c4a8cc8b587b1c6c260f3271584cbdf627138d019416cadc3205b4
-
SHA512
c015e112d52ba6e5f536c236fe7492a22785d6020f07aa0fb6fd0bd5487c07f639fd2acb923f79b4047e096cc95187f3ac01ad2dc2e59ebd1afb6ef1311a0551
-
SSDEEP
3072:3ffqwt4wIqYhb5tgBPT1l6raJzbKDQV7xmM0pI5CghOj7FlkHGe2:3KweW00BLrT7MZI5vOjR
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1956 1476 rundll32.exe 27 PID 1476 wrote to memory of 1956 1476 rundll32.exe 27 PID 1476 wrote to memory of 1956 1476 rundll32.exe 27 PID 1476 wrote to memory of 1956 1476 rundll32.exe 27 PID 1476 wrote to memory of 1956 1476 rundll32.exe 27 PID 1476 wrote to memory of 1956 1476 rundll32.exe 27 PID 1476 wrote to memory of 1956 1476 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c143a9fa4c4a8cc8b587b1c6c260f3271584cbdf627138d019416cadc3205b4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c143a9fa4c4a8cc8b587b1c6c260f3271584cbdf627138d019416cadc3205b4.dll,#12⤵PID:1956
-