Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
19/08/2023, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
785adb09837e20f9240e53f6ad9334b746fb30ecd63578ccf553e22fefdfa3f6.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
785adb09837e20f9240e53f6ad9334b746fb30ecd63578ccf553e22fefdfa3f6.dll
Resource
win10v2004-20230703-en
General
-
Target
785adb09837e20f9240e53f6ad9334b746fb30ecd63578ccf553e22fefdfa3f6.dll
-
Size
2.3MB
-
MD5
2df6f98e363cfd55c79f36dab760851f
-
SHA1
d1fd5eee0d70d2987146acf2e60e7ee29b1645d6
-
SHA256
785adb09837e20f9240e53f6ad9334b746fb30ecd63578ccf553e22fefdfa3f6
-
SHA512
77e3640e6a402acf1c44db87fa29672b9400bd9c3983f35afc0edbc84f40e9a5d48bd0c7aea77aa30636193146d3c2f9dc579922bce21f672cc294cac9c3dd63
-
SSDEEP
49152:zwmH4n/R1PbgYggC9aAayWrB9uCFwPRPrQoQPqwlKG4C/PqKqnFqPl7FJr:q/R1PbgYDC9aAaDt9ZFIRPr9hIt4C/Pz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2992 2192 rundll32.exe 28 PID 2192 wrote to memory of 2992 2192 rundll32.exe 28 PID 2192 wrote to memory of 2992 2192 rundll32.exe 28 PID 2192 wrote to memory of 2992 2192 rundll32.exe 28 PID 2192 wrote to memory of 2992 2192 rundll32.exe 28 PID 2192 wrote to memory of 2992 2192 rundll32.exe 28 PID 2192 wrote to memory of 2992 2192 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\785adb09837e20f9240e53f6ad9334b746fb30ecd63578ccf553e22fefdfa3f6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\785adb09837e20f9240e53f6ad9334b746fb30ecd63578ccf553e22fefdfa3f6.dll,#12⤵PID:2992
-