Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 20:16
Behavioral task
behavioral1
Sample
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll
Resource
win10v2004-20220812-en
General
-
Target
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll
-
Size
81KB
-
MD5
e1f8c6beddd96fb99c637110345101a1
-
SHA1
d638f0e656ec96e13de048bd293d2bdc07897846
-
SHA256
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd
-
SHA512
36a5cc73484783105465d33f70bfeb0fe2dd9dd49f7c0873c6bb57adfada8b04290f1944b36574740db8f90ce32a6ea278c2cdf38c47fb1b4bc1aaef31e5711f
-
SSDEEP
1536:2GIlup9wNrigSBVSnxkhU+e7+xiqTAj2BJMgUFiRLA1uW2o9:2GLGdigSiG8zabNU8RLA1tP9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1608 wrote to memory of 2004 1608 rundll32.exe 26 PID 1608 wrote to memory of 2004 1608 rundll32.exe 26 PID 1608 wrote to memory of 2004 1608 rundll32.exe 26 PID 1608 wrote to memory of 2004 1608 rundll32.exe 26 PID 1608 wrote to memory of 2004 1608 rundll32.exe 26 PID 1608 wrote to memory of 2004 1608 rundll32.exe 26 PID 1608 wrote to memory of 2004 1608 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll,#12⤵PID:2004
-