Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
28/10/2023, 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.e26e2902d6864678cfb00234cfa22170.dll
Resource
win7-20231020-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.e26e2902d6864678cfb00234cfa22170.dll
Resource
win10v2004-20231025-en
1 signatures
150 seconds
General
-
Target
NEAS.e26e2902d6864678cfb00234cfa22170.dll
-
Size
289KB
-
MD5
e26e2902d6864678cfb00234cfa22170
-
SHA1
e853fa43caa5bf70e228e62350c335879ebf317e
-
SHA256
de3fc3f5e84a73ea9eec80860cd4886988755728cb0e2c51c997aef385f847e1
-
SHA512
6c8a3280147e9c27ff06e6a35300ae6f0a087aaebf05e7fa9fc533391f739e64f82b571d296faea969878132efe8971d912aac2d5ad302ec2f806099fba3b8f3
-
SSDEEP
3072:jjO/G0OiBbOF4a6wHO3IVeuXZMJkzh/o92JAYFJttYakMaOnp:jjOpP1OL6wHO3IV4JkzhwmzJNkMa
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2804 2784 rundll32.exe 29 PID 2784 wrote to memory of 2804 2784 rundll32.exe 29 PID 2784 wrote to memory of 2804 2784 rundll32.exe 29 PID 2784 wrote to memory of 2804 2784 rundll32.exe 29 PID 2784 wrote to memory of 2804 2784 rundll32.exe 29 PID 2784 wrote to memory of 2804 2784 rundll32.exe 29 PID 2784 wrote to memory of 2804 2784 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e26e2902d6864678cfb00234cfa22170.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e26e2902d6864678cfb00234cfa22170.dll,#12⤵PID:2804
-