Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
11/11/2023, 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.5ea03510fcd914709a8674f851e23020.dll
Resource
win7-20231023-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.5ea03510fcd914709a8674f851e23020.dll
Resource
win10v2004-20231023-en
1 signatures
150 seconds
General
-
Target
NEAS.5ea03510fcd914709a8674f851e23020.dll
-
Size
2.1MB
-
MD5
5ea03510fcd914709a8674f851e23020
-
SHA1
f89366f729d0809ebfc5a63fc59835fdfd31b4c2
-
SHA256
4101fc9747403d07aa44ed5e7671aef9cf3379491ee462588eeef3938aa1bc72
-
SHA512
7c0a5d2d58a9391b9971cdf0f95d9c2c9e0a24a6384835647adca41733a8c4198ef1e016ed209b02628ef3efd0994959fcc27b2da17feb0d51f89584452f3490
-
SSDEEP
49152:qacWsgO1Qt3usmqNb40Z1NdEcCQg3JecLq5yw531KBe7ZHD:qB/gy+JmS8C1MPIov0D
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2128 2260 rundll32.exe 28 PID 2260 wrote to memory of 2128 2260 rundll32.exe 28 PID 2260 wrote to memory of 2128 2260 rundll32.exe 28 PID 2260 wrote to memory of 2128 2260 rundll32.exe 28 PID 2260 wrote to memory of 2128 2260 rundll32.exe 28 PID 2260 wrote to memory of 2128 2260 rundll32.exe 28 PID 2260 wrote to memory of 2128 2260 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5ea03510fcd914709a8674f851e23020.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5ea03510fcd914709a8674f851e23020.dll,#12⤵PID:2128
-