Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
0s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14b28a43785254415ce74667a2fb30ab.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
14b28a43785254415ce74667a2fb30ab.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
14b28a43785254415ce74667a2fb30ab.dll
-
Size
29KB
-
MD5
14b28a43785254415ce74667a2fb30ab
-
SHA1
2179fc5120136ebec55242a004054d470dc38bbe
-
SHA256
276f469b7e1675b442223b64660257ea84ee15d276868015ec12b49e64ec86da
-
SHA512
d4f724fae72d726da902a8e3c8ab8267dc9a23c90c3a21fc780c3df2961cebcb77697402ef38317bb7d7172aadadf791bdde51a3ba92e360d4484d8acf76d886
-
SSDEEP
768:4UhOBrTv6uPaeVbvci/8f+kUVw7DRriyrfdSM:49V5aeVb0i/8GRw7brFSM
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2060 1448 rundll32.exe 28 PID 1448 wrote to memory of 2060 1448 rundll32.exe 28 PID 1448 wrote to memory of 2060 1448 rundll32.exe 28 PID 1448 wrote to memory of 2060 1448 rundll32.exe 28 PID 1448 wrote to memory of 2060 1448 rundll32.exe 28 PID 1448 wrote to memory of 2060 1448 rundll32.exe 28 PID 1448 wrote to memory of 2060 1448 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\14b28a43785254415ce74667a2fb30ab.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\14b28a43785254415ce74667a2fb30ab.dll,#12⤵PID:2060
-