Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
eca13d1e0473c37c36a410c7afe6c0364188b93520e236327e07d8fa8b94a9d9.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
eca13d1e0473c37c36a410c7afe6c0364188b93520e236327e07d8fa8b94a9d9.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
eca13d1e0473c37c36a410c7afe6c0364188b93520e236327e07d8fa8b94a9d9.dll
-
Size
3KB
-
MD5
135e2af6aa143beeb837033f22ad7120
-
SHA1
eb0da323ccfaa298561be16c04d471addac1add7
-
SHA256
eca13d1e0473c37c36a410c7afe6c0364188b93520e236327e07d8fa8b94a9d9
-
SHA512
9c583326020d16e551dc1b67a309a0aa0bd0fcd14da51e3b1731c219314215bd06544d3f90a1f604e7e1006a7d22cb429041d40fb8afd0520018cf3ae72c8f14
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1476 1096 rundll32.exe 26 PID 1096 wrote to memory of 1476 1096 rundll32.exe 26 PID 1096 wrote to memory of 1476 1096 rundll32.exe 26 PID 1096 wrote to memory of 1476 1096 rundll32.exe 26 PID 1096 wrote to memory of 1476 1096 rundll32.exe 26 PID 1096 wrote to memory of 1476 1096 rundll32.exe 26 PID 1096 wrote to memory of 1476 1096 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eca13d1e0473c37c36a410c7afe6c0364188b93520e236327e07d8fa8b94a9d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eca13d1e0473c37c36a410c7afe6c0364188b93520e236327e07d8fa8b94a9d9.dll,#12⤵PID:1476
-