Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
e7c236467275da9b75945fde691106318a5314d3913cf40bab6aa3aee236c489.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e7c236467275da9b75945fde691106318a5314d3913cf40bab6aa3aee236c489.dll
Resource
win10v2004-20230915-en
General
-
Target
e7c236467275da9b75945fde691106318a5314d3913cf40bab6aa3aee236c489.dll
-
Size
2.1MB
-
MD5
4ea81fa9dfc70af28cbed13dbcf27be2
-
SHA1
21ae68ac397f5158f50e87fbba5428cec5973da3
-
SHA256
e7c236467275da9b75945fde691106318a5314d3913cf40bab6aa3aee236c489
-
SHA512
e05e8226c4974bfe5af41db92ca7770ee24ec7499717d997a37ba6cc8a09b7b12aeab3849d54865f2278ee7b67eead32c3bd9ebb9cbd41e3e0e76d2da2c2462a
-
SSDEEP
49152:vcz84B8m/2JoQAXJm9mEfZOkNPSTqctjRTDpJMM8:k7qm/uMcDPSTqsL58
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1584 1368 rundll32.exe 21 PID 1368 wrote to memory of 1584 1368 rundll32.exe 21 PID 1368 wrote to memory of 1584 1368 rundll32.exe 21 PID 1368 wrote to memory of 1584 1368 rundll32.exe 21 PID 1368 wrote to memory of 1584 1368 rundll32.exe 21 PID 1368 wrote to memory of 1584 1368 rundll32.exe 21 PID 1368 wrote to memory of 1584 1368 rundll32.exe 21
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7c236467275da9b75945fde691106318a5314d3913cf40bab6aa3aee236c489.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7c236467275da9b75945fde691106318a5314d3913cf40bab6aa3aee236c489.dll,#12⤵PID:1584
-