Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
15/02/2023, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
7178cf383004f713032b968570fcb87a49c640bab28e510520775469a1b6d94e.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7178cf383004f713032b968570fcb87a49c640bab28e510520775469a1b6d94e.dll
Resource
win10v2004-20221111-en
General
-
Target
7178cf383004f713032b968570fcb87a49c640bab28e510520775469a1b6d94e.dll
-
Size
640KB
-
MD5
2bb21749f2cbdc3b875a2e808e2eacc2
-
SHA1
5fdebb5740eacb6d80a08396e736445e3e629439
-
SHA256
7178cf383004f713032b968570fcb87a49c640bab28e510520775469a1b6d94e
-
SHA512
6629dc2f8d7788f4fad8db22bd6bd69e420fe775366951f5e0161d2feed54d0e52fb110714aad7f22eb1de6977d3b6db8b1175f3b845ffb17110ad1cccd93524
-
SSDEEP
12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tTd3+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1thJ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1232 wrote to memory of 1428 1232 rundll32.exe 28 PID 1232 wrote to memory of 1428 1232 rundll32.exe 28 PID 1232 wrote to memory of 1428 1232 rundll32.exe 28 PID 1232 wrote to memory of 1428 1232 rundll32.exe 28 PID 1232 wrote to memory of 1428 1232 rundll32.exe 28 PID 1232 wrote to memory of 1428 1232 rundll32.exe 28 PID 1232 wrote to memory of 1428 1232 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7178cf383004f713032b968570fcb87a49c640bab28e510520775469a1b6d94e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7178cf383004f713032b968570fcb87a49c640bab28e510520775469a1b6d94e.dll,#12⤵PID:1428
-