Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 22:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
148f9a5f5b308b9be0d938f9c4f7f744.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
148f9a5f5b308b9be0d938f9c4f7f744.dll
Resource
win10v2004-20231222-en
5 signatures
150 seconds
General
-
Target
148f9a5f5b308b9be0d938f9c4f7f744.dll
-
Size
187KB
-
MD5
148f9a5f5b308b9be0d938f9c4f7f744
-
SHA1
9b0d6bb5fbc572bc83d804b12f5df66def846165
-
SHA256
e3df1a04b34d96b3c65b3c133aceca60444adf23771a7ff12df10df88bd835b0
-
SHA512
a7d7237d4e592cd83bd6f9bf7b7b9dabc5724429735c8efbb9f9f28fd63c40a3765d76f0d6c803a0b80a606fa4803234efc2dcac9447a5cc058760d1159ed4f3
-
SSDEEP
3072:4ZO4Rd/yv8GoZegvVSbymnDSnyHOTgkTCxktFy7JHVtWZdncjlB:F4r/iEIznun5gsdW7NVtWDcX
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2220 1424 rundll32.exe 17 PID 1424 wrote to memory of 2220 1424 rundll32.exe 17 PID 1424 wrote to memory of 2220 1424 rundll32.exe 17 PID 1424 wrote to memory of 2220 1424 rundll32.exe 17 PID 1424 wrote to memory of 2220 1424 rundll32.exe 17 PID 1424 wrote to memory of 2220 1424 rundll32.exe 17 PID 1424 wrote to memory of 2220 1424 rundll32.exe 17
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\148f9a5f5b308b9be0d938f9c4f7f744.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\148f9a5f5b308b9be0d938f9c4f7f744.dll,#12⤵PID:2220
-