Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10/01/2023, 14:15
Static task
static1
Behavioral task
behavioral1
Sample
65848a4238b9a017a648b10883c9e753aec6f5faf0fc64641ff71b6be0794245.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
65848a4238b9a017a648b10883c9e753aec6f5faf0fc64641ff71b6be0794245.dll
Resource
win10v2004-20220812-en
General
-
Target
65848a4238b9a017a648b10883c9e753aec6f5faf0fc64641ff71b6be0794245.dll
-
Size
346KB
-
MD5
40f4df4f9378e3a09e6246d511f345f0
-
SHA1
bc3f92cc4aefe424e4abc0eb118403cdc9ab61cf
-
SHA256
65848a4238b9a017a648b10883c9e753aec6f5faf0fc64641ff71b6be0794245
-
SHA512
c5ebe442f05f8800f4d14ac014171946e90f9f226958971ab4f3bb91a92418c13a4885ff5cb7bcfa7bb80accf64b4fa1480957700a9c161e26762ca94227544f
-
SSDEEP
3072:yrtqQetF9zDiYrtqQetF9zDi5lHu9boNiFlyv4xeXCGAnYdTurIjiEcghpF:yrtqdviYrtqdvibomwlyQe5AnYd8GrF
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65848a4238b9a017a648b10883c9e753aec6f5faf0fc64641ff71b6be0794245.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65848a4238b9a017a648b10883c9e753aec6f5faf0fc64641ff71b6be0794245.dll,#12⤵PID:1764
-