Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/04/2023, 18:50
Static task
static1
Behavioral task
behavioral1
Sample
15d97a3fe6ace64e04b1e1c1def4ea331857a91952637edafc3bd9a036aed44f.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
15d97a3fe6ace64e04b1e1c1def4ea331857a91952637edafc3bd9a036aed44f.dll
Resource
win10v2004-20230220-en
General
-
Target
15d97a3fe6ace64e04b1e1c1def4ea331857a91952637edafc3bd9a036aed44f.dll
-
Size
76KB
-
MD5
174d8da65e750022d8c4be58897ee49b
-
SHA1
ca742243cc84e74560c3940342f7c6d3ce412a0f
-
SHA256
15d97a3fe6ace64e04b1e1c1def4ea331857a91952637edafc3bd9a036aed44f
-
SHA512
c32142c1d4d5269c3edb497f469f2635048da1276d5c040e59379b80f29b2ef8420fcbf47c6c2dd4f8700965fa6eefac7c092bb4105d3260dd7000f1651440ef
-
SSDEEP
1536:swebdY4nVbls3nQwJwN27vfdaA9pwZi/21NWizmZJS:Cn43nQ3N27Hd39pwM+NWii
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1532 628 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1740 wrote to memory of 628 1740 rundll32.exe 28 PID 1740 wrote to memory of 628 1740 rundll32.exe 28 PID 1740 wrote to memory of 628 1740 rundll32.exe 28 PID 1740 wrote to memory of 628 1740 rundll32.exe 28 PID 1740 wrote to memory of 628 1740 rundll32.exe 28 PID 1740 wrote to memory of 628 1740 rundll32.exe 28 PID 1740 wrote to memory of 628 1740 rundll32.exe 28 PID 628 wrote to memory of 1532 628 rundll32.exe 29 PID 628 wrote to memory of 1532 628 rundll32.exe 29 PID 628 wrote to memory of 1532 628 rundll32.exe 29 PID 628 wrote to memory of 1532 628 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15d97a3fe6ace64e04b1e1c1def4ea331857a91952637edafc3bd9a036aed44f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15d97a3fe6ace64e04b1e1c1def4ea331857a91952637edafc3bd9a036aed44f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 2523⤵
- Program crash
PID:1532
-
-