Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
469e6e7c6b34865a87a3495aa725804a.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
469e6e7c6b34865a87a3495aa725804a.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
469e6e7c6b34865a87a3495aa725804a.dll
-
Size
72KB
-
MD5
469e6e7c6b34865a87a3495aa725804a
-
SHA1
b9c9c27a77ec0ab8c45a1b182d7b2bdfeecfb98d
-
SHA256
040d73c6c091c2ba0de7794be53697411f5090c803f19e15d025a17a2662b4d6
-
SHA512
9029297f9d811d16245e103d179ce5251b16cdd4844c5ed1cbd88c4897d6ce2f511cddb7cb881d99f276f090d63bd5080d8c5a3f0ca36137e2b3e3975528847b
-
SSDEEP
1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1104 1724 rundll32.exe 16 PID 1724 wrote to memory of 1104 1724 rundll32.exe 16 PID 1724 wrote to memory of 1104 1724 rundll32.exe 16 PID 1724 wrote to memory of 1104 1724 rundll32.exe 16 PID 1724 wrote to memory of 1104 1724 rundll32.exe 16 PID 1724 wrote to memory of 1104 1724 rundll32.exe 16 PID 1724 wrote to memory of 1104 1724 rundll32.exe 16
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\469e6e7c6b34865a87a3495aa725804a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\469e6e7c6b34865a87a3495aa725804a.dll,#12⤵PID:1104
-