Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 23:49

General

  • Target

    72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll

  • Size

    212KB

  • MD5

    6b30060f5c4f829c2134e411828f3981

  • SHA1

    0e25174116fe7ddcc5c9a2785fb6429620cab389

  • SHA256

    72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a

  • SHA512

    6fda8848eb6a5c252ebd19a2a296ecc90ec22bd34523389a55afeab344a09f49d286b34bc67dc5e5ebb2386173f6f762cbc2d9928307865a0e233a080747dff9

  • SSDEEP

    3072:Kfof6T/oelUit28FfmQwgSpxX2vcVKbhj8OiZVEZfroH0B9p8uptCir:Kfof6zo0FfZwrLXj8bhmZmZG0B91

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 228
        3⤵
        • Program crash
        PID:480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/520-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

    Filesize

    8KB