Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ed185c32b737d811e5590cafdc51eed.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ed185c32b737d811e5590cafdc51eed.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
5ed185c32b737d811e5590cafdc51eed.dll
-
Size
6KB
-
MD5
5ed185c32b737d811e5590cafdc51eed
-
SHA1
9713f86f77cdb6b36183e7c2031e4dfb5de7a11f
-
SHA256
a95d54401de2271df517538dba2113ed3a94d7f92ebb8e29baa9634ee4250dbc
-
SHA512
88d79cb29353d1f92a5c754ef6c3854b2b08d5f1e5f64be57efbfb0cacb36b72f242057a98a39394f985fd4c98459bd0b34aed46e6573d712c704a548e5a42df
-
SSDEEP
48:63mll5YVOa9VUX1iwbQWu0SB+BDq9J5SH:VDa9VUX9bQWyB+FqX5SH
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2668 wrote to memory of 320 2668 rundll32.exe 30 PID 2668 wrote to memory of 320 2668 rundll32.exe 30 PID 2668 wrote to memory of 320 2668 rundll32.exe 30 PID 2668 wrote to memory of 320 2668 rundll32.exe 30 PID 2668 wrote to memory of 320 2668 rundll32.exe 30 PID 2668 wrote to memory of 320 2668 rundll32.exe 30 PID 2668 wrote to memory of 320 2668 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed185c32b737d811e5590cafdc51eed.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed185c32b737d811e5590cafdc51eed.dll,#12⤵PID:320
-