Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
231s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 00:33
Behavioral task
behavioral1
Sample
d27f09772c7d50dc50af28f0d71022c6557c9b9c241268da2576228f4ebff14d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d27f09772c7d50dc50af28f0d71022c6557c9b9c241268da2576228f4ebff14d.dll
Resource
win10v2004-20220812-en
General
-
Target
d27f09772c7d50dc50af28f0d71022c6557c9b9c241268da2576228f4ebff14d.dll
-
Size
63KB
-
MD5
161d444d7177149887194f7e590cdf4b
-
SHA1
cdb050cac59977e82ba630de53dc9bcbf4d84a3a
-
SHA256
d27f09772c7d50dc50af28f0d71022c6557c9b9c241268da2576228f4ebff14d
-
SHA512
da876a65bef3025657688762c8499e4f78b5d85b572dccb4f28ec721643f98c42e4a9acf8cd8e70a604b19b838e4937808169157938ec1f5c47ba5f6cee0e9ee
-
SSDEEP
1536:DWk1dx+vXe8ogOhf1Q8ElwhVUtjuWLJrzCDvn:SAPm6m8JQuWLJKn
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 760 wrote to memory of 1464 760 rundll32.exe 28 PID 760 wrote to memory of 1464 760 rundll32.exe 28 PID 760 wrote to memory of 1464 760 rundll32.exe 28 PID 760 wrote to memory of 1464 760 rundll32.exe 28 PID 760 wrote to memory of 1464 760 rundll32.exe 28 PID 760 wrote to memory of 1464 760 rundll32.exe 28 PID 760 wrote to memory of 1464 760 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d27f09772c7d50dc50af28f0d71022c6557c9b9c241268da2576228f4ebff14d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d27f09772c7d50dc50af28f0d71022c6557c9b9c241268da2576228f4ebff14d.dll,#12⤵PID:1464
-