Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
a4014caca28a4f2495e3a23a6cd9ea1eb24120e16556a8461d230bb05e9322f9.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a4014caca28a4f2495e3a23a6cd9ea1eb24120e16556a8461d230bb05e9322f9.dll
Resource
win10v2004-20230915-en
General
-
Target
a4014caca28a4f2495e3a23a6cd9ea1eb24120e16556a8461d230bb05e9322f9.dll
-
Size
1.8MB
-
MD5
eb3c62a125e435e056a299ff4dc0e24e
-
SHA1
282a63dca645aba7b5ec50e0030ce3ab14da6f4f
-
SHA256
a4014caca28a4f2495e3a23a6cd9ea1eb24120e16556a8461d230bb05e9322f9
-
SHA512
be227eaec3f972be744142d3462ee19ab151a263695dec0ac20dc2a8fda2da55e0780623782df230eac4a9b226cc927f829313bca360c96109034eaf5b30add7
-
SSDEEP
24576:xizFihoH7KYkQG+llJllllllllllllllll4C8oVPDYCl/g4t:xiwhCmQGeJg4t
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2960 1660 rundll32.exe 28 PID 1660 wrote to memory of 2960 1660 rundll32.exe 28 PID 1660 wrote to memory of 2960 1660 rundll32.exe 28 PID 1660 wrote to memory of 2960 1660 rundll32.exe 28 PID 1660 wrote to memory of 2960 1660 rundll32.exe 28 PID 1660 wrote to memory of 2960 1660 rundll32.exe 28 PID 1660 wrote to memory of 2960 1660 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4014caca28a4f2495e3a23a6cd9ea1eb24120e16556a8461d230bb05e9322f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4014caca28a4f2495e3a23a6cd9ea1eb24120e16556a8461d230bb05e9322f9.dll,#12⤵PID:2960
-