Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30/08/2023, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
948e2af90c55d362ddf3fcba1a37702ba6efb5cfb4d404e6421c77032b053e19.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
948e2af90c55d362ddf3fcba1a37702ba6efb5cfb4d404e6421c77032b053e19.dll
Resource
win10v2004-20230703-en
General
-
Target
948e2af90c55d362ddf3fcba1a37702ba6efb5cfb4d404e6421c77032b053e19.dll
-
Size
54KB
-
MD5
3de1d1f50c6fbdfb30dd335693c65345
-
SHA1
f1378cf6aeaf35b37a0af511b7c7c30d25d5fd78
-
SHA256
948e2af90c55d362ddf3fcba1a37702ba6efb5cfb4d404e6421c77032b053e19
-
SHA512
43923742a57d08c306f241325e4c9fe179ea20e2dd1acae75059cf996303b226aae6dc9ad0fa619bafd09cdb2aa1d3be851f4084fa7c76086f0a7356ebf4d85b
-
SSDEEP
768:BeVKAFjmaPvYERy+duM0GXZoiA2iz8xNwOD:a/FjmWFy+duDIaZ2iz8fBD
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2112 2608 rundll32.exe 28 PID 2608 wrote to memory of 2112 2608 rundll32.exe 28 PID 2608 wrote to memory of 2112 2608 rundll32.exe 28 PID 2608 wrote to memory of 2112 2608 rundll32.exe 28 PID 2608 wrote to memory of 2112 2608 rundll32.exe 28 PID 2608 wrote to memory of 2112 2608 rundll32.exe 28 PID 2608 wrote to memory of 2112 2608 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\948e2af90c55d362ddf3fcba1a37702ba6efb5cfb4d404e6421c77032b053e19.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\948e2af90c55d362ddf3fcba1a37702ba6efb5cfb4d404e6421c77032b053e19.dll,#12⤵PID:2112
-