Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00e0b32fc38cbdc0d380faf1417e0064.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
00e0b32fc38cbdc0d380faf1417e0064.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
00e0b32fc38cbdc0d380faf1417e0064.dll
-
Size
72KB
-
MD5
00e0b32fc38cbdc0d380faf1417e0064
-
SHA1
a9491b3e9b664e2126a0c9205b8db4f1937a4c5f
-
SHA256
e258ac027d9071413bc151de3381428e9e34a0cc2a4b5bce65e172474318bf00
-
SHA512
9bd3ccddb249f3a12fe860b65c67c6b739ddf09d4f422f441bda7d160750d6d433df0528d9e2ff6ce70b00721eacbc612d9859576833d587da60fc094d636a60
-
SSDEEP
1536:tt8fYBegtf7hmgVKYSf7xP2rUX9lZqLYLkEiiRzB8JW3x9qYU:ttT/f7hmgVKYSf7wskEiKB8JWfJU
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1416 wrote to memory of 2128 1416 rundll32.exe 28 PID 1416 wrote to memory of 2128 1416 rundll32.exe 28 PID 1416 wrote to memory of 2128 1416 rundll32.exe 28 PID 1416 wrote to memory of 2128 1416 rundll32.exe 28 PID 1416 wrote to memory of 2128 1416 rundll32.exe 28 PID 1416 wrote to memory of 2128 1416 rundll32.exe 28 PID 1416 wrote to memory of 2128 1416 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00e0b32fc38cbdc0d380faf1417e0064.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00e0b32fc38cbdc0d380faf1417e0064.dll,#12⤵PID:2128
-