Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll
Resource
win10v2004-20221111-en
General
-
Target
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll
-
Size
65KB
-
MD5
4322068e5b6f6d9080fa5bd602131130
-
SHA1
9fd3163089d1c9621d54792e0bf1cdd1dbf17043
-
SHA256
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d
-
SHA512
a15249313a7a9c06a419923c0830c45dd175769e5d885badabeea67b0855ce102319f2ebc11ca8724ac6cb9452f894dd076b832044ef9fea1ce2be8f6c0a0596
-
SSDEEP
1536:BjHaZJABplBaMWgd863SzTWTtZalE9LpJQm8l1:Bj6TAHBZ863SzTWLdVQm8l1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll,#12⤵PID:2012
-