Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 00:40
Behavioral task
behavioral1
Sample
f3f8b814a199deea7010a1e4384d3405700dd48ff169d2bc6c396c4f1af1fc86.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f3f8b814a199deea7010a1e4384d3405700dd48ff169d2bc6c396c4f1af1fc86.dll
Resource
win10v2004-20220812-en
General
-
Target
f3f8b814a199deea7010a1e4384d3405700dd48ff169d2bc6c396c4f1af1fc86.dll
-
Size
78KB
-
MD5
fc79db7bbcaec938d25621b22e3fb49e
-
SHA1
8fcde50768f759d8e841ed1fdc98cf4df30ecff3
-
SHA256
f3f8b814a199deea7010a1e4384d3405700dd48ff169d2bc6c396c4f1af1fc86
-
SHA512
10b23fd365a552ab487cd3e89c27a479208918a0ce78c274354df69e6e318c111480a82c4d0c9f67a7fadaa56f680e879773bf618342454edcc2db38ea2f22ff
-
SSDEEP
1536:qmmMhHWpcpmRjjSDuYJIzzinpFVyU+Z/o3E2XRU1iU:QMhpw9mb7pFi/ohKiU
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1468 wrote to memory of 1268 1468 rundll32.exe 28 PID 1468 wrote to memory of 1268 1468 rundll32.exe 28 PID 1468 wrote to memory of 1268 1468 rundll32.exe 28 PID 1468 wrote to memory of 1268 1468 rundll32.exe 28 PID 1468 wrote to memory of 1268 1468 rundll32.exe 28 PID 1468 wrote to memory of 1268 1468 rundll32.exe 28 PID 1468 wrote to memory of 1268 1468 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f3f8b814a199deea7010a1e4384d3405700dd48ff169d2bc6c396c4f1af1fc86.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f3f8b814a199deea7010a1e4384d3405700dd48ff169d2bc6c396c4f1af1fc86.dll,#12⤵PID:1268
-