Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
950038d44354f0e5850ab60b5c194effbb07aa2c77a129fe2c55c5b6fb906dc9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
950038d44354f0e5850ab60b5c194effbb07aa2c77a129fe2c55c5b6fb906dc9.dll
Resource
win10v2004-20220812-en
General
-
Target
950038d44354f0e5850ab60b5c194effbb07aa2c77a129fe2c55c5b6fb906dc9.dll
-
Size
22KB
-
MD5
09b711948f047e41884dfeaf27560fd6
-
SHA1
57e5952cbee40f47250349864e93ef3b2e084094
-
SHA256
950038d44354f0e5850ab60b5c194effbb07aa2c77a129fe2c55c5b6fb906dc9
-
SHA512
c3d7c84f141bb36bfb6d46d35aff49cd66b86a604980204c514c47a52a53a9710b018ab0eda629d1a8f73f924b61b511fbc7804c216016b32aa447b14d0d2bc9
-
SSDEEP
384:9GnKzirGMA07iv1P4Usacva8pxabCBCyCfJCpLHGfJCpLpGfJCpLaGZC5MM:9GnEoGNvJ4/acva8ibGxCfGGfcGfvGZa
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\950038d44354f0e5850ab60b5c194effbb07aa2c77a129fe2c55c5b6fb906dc9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\950038d44354f0e5850ab60b5c194effbb07aa2c77a129fe2c55c5b6fb906dc9.dll,#12⤵PID:1956
-