Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
16/11/2023, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll
-
Size
180KB
-
MD5
67b6b48ff9d6b2a39c2a9afbbadb6e31
-
SHA1
8430d9d0f97722bbd1af3ceb6271a2b1b6b8632a
-
SHA256
98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e
-
SHA512
79bc21539fb4c92608def33768b2ddffb8cdb8b2ac5899a0d723233f0e4007c27403358872ca55843592b29a0d36b01b60ae53babefa14aec500643761cb1e95
-
SSDEEP
3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlL0bVaKoXAxOPYe:I74elpowsxizqyStZlpel5IyAxOPF
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2480 2456 rundll32.exe 27 PID 2456 wrote to memory of 2480 2456 rundll32.exe 27 PID 2456 wrote to memory of 2480 2456 rundll32.exe 27 PID 2456 wrote to memory of 2480 2456 rundll32.exe 27 PID 2456 wrote to memory of 2480 2456 rundll32.exe 27 PID 2456 wrote to memory of 2480 2456 rundll32.exe 27 PID 2456 wrote to memory of 2480 2456 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll,#12⤵PID:2480
-