Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
19/11/2023, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
262bc18e4ed8ddeef78253b5ee923e4081c2d7c95fd4d1df26396da7babfac1f.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
262bc18e4ed8ddeef78253b5ee923e4081c2d7c95fd4d1df26396da7babfac1f.dll
Resource
win10v2004-20231023-en
General
-
Target
262bc18e4ed8ddeef78253b5ee923e4081c2d7c95fd4d1df26396da7babfac1f.dll
-
Size
344KB
-
MD5
652f803b7070a761e9018c2e86b26f69
-
SHA1
6862f0ac92c6acc8d533cdb00e33d5ef310a101f
-
SHA256
262bc18e4ed8ddeef78253b5ee923e4081c2d7c95fd4d1df26396da7babfac1f
-
SHA512
1bc169cd106cd1caacd18603c2933bd135c5247a1771295e69bc2020670e7932b1834b5848823566bc967cab71612126d0cc877123b377d9abf5bf1b86ba2f46
-
SSDEEP
6144:galttpwlkGC9EayqL0I5Ahokm5AO+Q6zLVeEXdZoKIhVvVf0sGSysejk:3ltPwlkGC9EWL/6mSRzEXq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 536 wrote to memory of 2760 536 rundll32.exe 28 PID 536 wrote to memory of 2760 536 rundll32.exe 28 PID 536 wrote to memory of 2760 536 rundll32.exe 28 PID 536 wrote to memory of 2760 536 rundll32.exe 28 PID 536 wrote to memory of 2760 536 rundll32.exe 28 PID 536 wrote to memory of 2760 536 rundll32.exe 28 PID 536 wrote to memory of 2760 536 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\262bc18e4ed8ddeef78253b5ee923e4081c2d7c95fd4d1df26396da7babfac1f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\262bc18e4ed8ddeef78253b5ee923e4081c2d7c95fd4d1df26396da7babfac1f.dll,#12⤵PID:2760
-