Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 04:48
Behavioral task
behavioral1
Sample
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll
Resource
win10v2004-20230824-en
General
-
Target
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll
-
Size
51KB
-
MD5
a21fdd14fb1e00e0e9943b7d59be4842
-
SHA1
8b2453b41f1376a18a00884858352c6bfb93cab9
-
SHA256
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8
-
SHA512
cb97f73893a66f006cc5235802dca691336a928445351b4c22130378c2a5a8a2a04075effc4757963c8d8e3756a2647e342ebfea86a9bc46f4f297255882590a
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLDJYH5:1dWubF3n9S91BF3fbonJYH5
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2088 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2088 2008 rundll32.exe 30 PID 2008 wrote to memory of 2088 2008 rundll32.exe 30 PID 2008 wrote to memory of 2088 2008 rundll32.exe 30 PID 2008 wrote to memory of 2088 2008 rundll32.exe 30 PID 2008 wrote to memory of 2088 2008 rundll32.exe 30 PID 2008 wrote to memory of 2088 2008 rundll32.exe 30 PID 2008 wrote to memory of 2088 2008 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2088
-