Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/08/2023, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
Resource
win10v2004-20230703-en
General
-
Target
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
-
Size
213KB
-
MD5
fba481774812fa3c6424bece81f4923d
-
SHA1
cd93cc0fc436dd9cffda641f62edfd9409c3066d
-
SHA256
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e
-
SHA512
e7c5a659d3e15e53a3247c90175d4c7a8dacffd34a551c090b9c8478f2b9883cde9790e181b7f4cc74a8ce767537111c4cf279a8e0a9ffb9332a44c2aeece9b4
-
SSDEEP
1536:N8ZkXEMm6jh/3XNPpdpytxr5QSM9JaIbRZmFcPgHrme:PEA3XNItTQSM9JaIbRZmFcPle
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1132 wrote to memory of 2276 1132 rundll32.exe 28 PID 1132 wrote to memory of 2276 1132 rundll32.exe 28 PID 1132 wrote to memory of 2276 1132 rundll32.exe 28 PID 1132 wrote to memory of 2276 1132 rundll32.exe 28 PID 1132 wrote to memory of 2276 1132 rundll32.exe 28 PID 1132 wrote to memory of 2276 1132 rundll32.exe 28 PID 1132 wrote to memory of 2276 1132 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#12⤵PID:2276
-