Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28a07aae9b2ee66432ffe7f64a1c44b7.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
28a07aae9b2ee66432ffe7f64a1c44b7.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
28a07aae9b2ee66432ffe7f64a1c44b7.dll
-
Size
94KB
-
MD5
28a07aae9b2ee66432ffe7f64a1c44b7
-
SHA1
33922dea07a7fe512e02208eba5c76294aafa1eb
-
SHA256
65107f2062fdb116ebdca4b3631e483fe8cdc8a19e31dac2274a47be700e0143
-
SHA512
6ae72469fcf5536c9f6faa04c4cbe8c27c3eb10640344df3c62b115544e2abb99eb5b1f5a77b24616d478d23b52c86ba2010c25e3fa81d23cbd4c70e52886cbc
-
SSDEEP
1536:RzS/6HacmkVBVqwe3BzKDOgSiQ+0fHB12XB4VWoNCsgQB9xinRIw/OvhBQD9FcTn:RE6HaA6AOxfHmcrgegRSvQXcTYUYsBr
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2316 1964 rundll32.exe 16 PID 1964 wrote to memory of 2316 1964 rundll32.exe 16 PID 1964 wrote to memory of 2316 1964 rundll32.exe 16 PID 1964 wrote to memory of 2316 1964 rundll32.exe 16 PID 1964 wrote to memory of 2316 1964 rundll32.exe 16 PID 1964 wrote to memory of 2316 1964 rundll32.exe 16 PID 1964 wrote to memory of 2316 1964 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28a07aae9b2ee66432ffe7f64a1c44b7.dll,#11⤵PID:2316
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28a07aae9b2ee66432ffe7f64a1c44b7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1964