Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/01/2024, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
6817ab61680be83bee21de0fb78d3a8a1253c0c70d4518776de68b1ff82c760a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6817ab61680be83bee21de0fb78d3a8a1253c0c70d4518776de68b1ff82c760a.dll
Resource
win10v2004-20231215-en
General
-
Target
6817ab61680be83bee21de0fb78d3a8a1253c0c70d4518776de68b1ff82c760a.dll
-
Size
441KB
-
MD5
e57bd291f54bbf8f76f0c678593b6458
-
SHA1
c2506754c65c0eab932956182f69452cf4c5fda5
-
SHA256
6817ab61680be83bee21de0fb78d3a8a1253c0c70d4518776de68b1ff82c760a
-
SHA512
75947138a4b8cdebb8bae3d268a44a52e7d459e7f57c5a0dccce5c08515768d89accfe0185c9c8a4e32db51acefe31a7452b55b3289462bc1a194a441359c140
-
SSDEEP
12288:56266Msyw1TddEjdfZyroYHyF+gJgzgHYd:5XxCwiZyrLSjYd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1504 wrote to memory of 2124 1504 rundll32.exe 28 PID 1504 wrote to memory of 2124 1504 rundll32.exe 28 PID 1504 wrote to memory of 2124 1504 rundll32.exe 28 PID 1504 wrote to memory of 2124 1504 rundll32.exe 28 PID 1504 wrote to memory of 2124 1504 rundll32.exe 28 PID 1504 wrote to memory of 2124 1504 rundll32.exe 28 PID 1504 wrote to memory of 2124 1504 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6817ab61680be83bee21de0fb78d3a8a1253c0c70d4518776de68b1ff82c760a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6817ab61680be83bee21de0fb78d3a8a1253c0c70d4518776de68b1ff82c760a.dll,#12⤵PID:2124
-