Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll
Resource
win10v2004-20220901-en
General
-
Target
b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll
-
Size
364KB
-
MD5
c5e11c1b46fc4cac3643d9868b29f1db
-
SHA1
d4128f242378b63f9584645b14da68dd447ddf41
-
SHA256
b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7
-
SHA512
5fd5b08541e088382a32c7925b236d32c871e83b10ebad0772425847ac4395459da89813e64b9be7a6f02d0950301e4b3e1f510cc1713f29b23dcb88e73bde40
-
SSDEEP
6144:xWlCQzP9Boj79gKwZhQZBSvxMrQ1RRPFiCSjM0QMD/sMFMDIPO/rA:xWJIgLZhQOvWE1RRtiCSjBDnFM8Oz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll,#12⤵PID:1124
-