Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
50325ed8e8b64792d69b9feac76d6470.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
50325ed8e8b64792d69b9feac76d6470.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
50325ed8e8b64792d69b9feac76d6470.dll
-
Size
192KB
-
MD5
50325ed8e8b64792d69b9feac76d6470
-
SHA1
3b7497f6d047690a1c95293faa2d76a7b3d67cbb
-
SHA256
1ba5f45a6611debd9d1052eab88dbc0f1854cca87dd2dfbb1256ac93116578a4
-
SHA512
884fe3960e0da29137daef57fd2658e23f8fe4d420d0de89ecd8656581c9f554e000635334ce2bb52f60914cbb0fbdb9e3adc8fb0568dfa64d68ac0e0552fe07
-
SSDEEP
3072:FNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrmq:FNbqaLD7RcukVAtSQOWcgWqbV77Lmq
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2944 wrote to memory of 3048 2944 rundll32.exe 28 PID 2944 wrote to memory of 3048 2944 rundll32.exe 28 PID 2944 wrote to memory of 3048 2944 rundll32.exe 28 PID 2944 wrote to memory of 3048 2944 rundll32.exe 28 PID 2944 wrote to memory of 3048 2944 rundll32.exe 28 PID 2944 wrote to memory of 3048 2944 rundll32.exe 28 PID 2944 wrote to memory of 3048 2944 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\50325ed8e8b64792d69b9feac76d6470.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\50325ed8e8b64792d69b9feac76d6470.dll,#12⤵PID:3048
-