Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 02:29
Static task
static1
Behavioral task
behavioral1
Sample
f838a69c416b252d1c482aec24b8dfded30e9b6e58b72357271ca9f5553a1f4c.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f838a69c416b252d1c482aec24b8dfded30e9b6e58b72357271ca9f5553a1f4c.dll
Resource
win10v2004-20230915-en
General
-
Target
f838a69c416b252d1c482aec24b8dfded30e9b6e58b72357271ca9f5553a1f4c.dll
-
Size
2.1MB
-
MD5
31f36bf20144370de892a2baabb0cfcc
-
SHA1
1e3efb016154ef9dc15897d0efa432d89b3d19ad
-
SHA256
f838a69c416b252d1c482aec24b8dfded30e9b6e58b72357271ca9f5553a1f4c
-
SHA512
5aa0428c0c73f7d3d7c45d18a61f6cb82e43057e8ce213ce41951b1a9f7eaa591810da5f96e1b99d0c7eda47c2db151f6d5d7fcb5b9e5f512b3c016468b34c3d
-
SSDEEP
49152:EOWIxDipHCCQo7Ee/ZUyqkyjLZwmS7uqZJ/t2bs3McihIqdqYU:EuOvr7EehUvkCNEKUJ/t2bs3Mci
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2332 2092 rundll32.exe 28 PID 2092 wrote to memory of 2332 2092 rundll32.exe 28 PID 2092 wrote to memory of 2332 2092 rundll32.exe 28 PID 2092 wrote to memory of 2332 2092 rundll32.exe 28 PID 2092 wrote to memory of 2332 2092 rundll32.exe 28 PID 2092 wrote to memory of 2332 2092 rundll32.exe 28 PID 2092 wrote to memory of 2332 2092 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f838a69c416b252d1c482aec24b8dfded30e9b6e58b72357271ca9f5553a1f4c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f838a69c416b252d1c482aec24b8dfded30e9b6e58b72357271ca9f5553a1f4c.dll,#12⤵PID:2332
-