Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
5522ba4043eea103aa4b34500bf9b534053bcf3b907db6fe181591dcc44702f9.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5522ba4043eea103aa4b34500bf9b534053bcf3b907db6fe181591dcc44702f9.dll
Resource
win10v2004-20230915-en
General
-
Target
5522ba4043eea103aa4b34500bf9b534053bcf3b907db6fe181591dcc44702f9.dll
-
Size
2.1MB
-
MD5
a2113a5ea8e40c7b47e02d067654bfcc
-
SHA1
7ee040a552bf7bbeff56694412ab95a0aaf0121e
-
SHA256
5522ba4043eea103aa4b34500bf9b534053bcf3b907db6fe181591dcc44702f9
-
SHA512
961bd5cbd6dffc6d04cae4588495cf6399a76750a0b482f3ea1fade7976fbd9b3e1918380fdd227f386e5afe812a03c0e7b6ba7b36fb7ce9527a0d8d05d02c4e
-
SSDEEP
49152:vcz84B8m/mJo4AXJmLmEfZOkNPSTqctjRTDpJMMX:k7qm/yMcBPSTqsL5X
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1796 wrote to memory of 2088 1796 rundll32.exe 28 PID 1796 wrote to memory of 2088 1796 rundll32.exe 28 PID 1796 wrote to memory of 2088 1796 rundll32.exe 28 PID 1796 wrote to memory of 2088 1796 rundll32.exe 28 PID 1796 wrote to memory of 2088 1796 rundll32.exe 28 PID 1796 wrote to memory of 2088 1796 rundll32.exe 28 PID 1796 wrote to memory of 2088 1796 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5522ba4043eea103aa4b34500bf9b534053bcf3b907db6fe181591dcc44702f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5522ba4043eea103aa4b34500bf9b534053bcf3b907db6fe181591dcc44702f9.dll,#12⤵PID:2088
-