Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
13/11/2023, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
0893ab0c50c58faab360c4ad08149a2305773b508da6a8354fd0da378eecf41f.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0893ab0c50c58faab360c4ad08149a2305773b508da6a8354fd0da378eecf41f.dll
Resource
win10v2004-20231023-en
General
-
Target
0893ab0c50c58faab360c4ad08149a2305773b508da6a8354fd0da378eecf41f.dll
-
Size
2.2MB
-
MD5
0f8ec14048458e7a51a8701fbce25603
-
SHA1
b0586974dc54bfb88b96848813f9e68783ecd472
-
SHA256
0893ab0c50c58faab360c4ad08149a2305773b508da6a8354fd0da378eecf41f
-
SHA512
508e4bca18b08c175f9e260512bc6b14ab594aa4f86200a6fdbc9a8eb003206b0f4b5a8d4d932d3de0836318e3a893d6dc45f7126691554f51688672c9f789e7
-
SSDEEP
49152:rd0OM5Fym/8RgJoYM97tQjFozL19wNa/WgC:rCOM56yJ5jFKp9JWgC
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2228 1716 rundll32.exe 28 PID 1716 wrote to memory of 2228 1716 rundll32.exe 28 PID 1716 wrote to memory of 2228 1716 rundll32.exe 28 PID 1716 wrote to memory of 2228 1716 rundll32.exe 28 PID 1716 wrote to memory of 2228 1716 rundll32.exe 28 PID 1716 wrote to memory of 2228 1716 rundll32.exe 28 PID 1716 wrote to memory of 2228 1716 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0893ab0c50c58faab360c4ad08149a2305773b508da6a8354fd0da378eecf41f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0893ab0c50c58faab360c4ad08149a2305773b508da6a8354fd0da378eecf41f.dll,#12⤵PID:2228
-