Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 11:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fb3c7e32f84d7720ca78e9bfc7f8224.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
7fb3c7e32f84d7720ca78e9bfc7f8224.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
7fb3c7e32f84d7720ca78e9bfc7f8224.dll
-
Size
57KB
-
MD5
7fb3c7e32f84d7720ca78e9bfc7f8224
-
SHA1
2ee723cf67624121f9d942c1328e90d27b4e593c
-
SHA256
559da6badb2092d46a96dc0ebc7419c54876edd78fa4f14837c822db88ec5332
-
SHA512
97b202c78ad4b75510918c39eb2a4dc38a92e26fd40b5f74efaa7d51f7c713839783c22b7b828de86451acb33322fc95af78a5fd83dd8ae6bb96626fdeb5f98e
-
SSDEEP
768:HnPIspNqsKap/K/U26go3UTRRYOoMoBb9CF5FoayLfcT2awAaVB2cqR:vQO5Kc1kTRRYg8m5FoayoT8A0
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 816 wrote to memory of 1244 816 rundll32.exe 14 PID 816 wrote to memory of 1244 816 rundll32.exe 14 PID 816 wrote to memory of 1244 816 rundll32.exe 14 PID 816 wrote to memory of 1244 816 rundll32.exe 14 PID 816 wrote to memory of 1244 816 rundll32.exe 14 PID 816 wrote to memory of 1244 816 rundll32.exe 14 PID 816 wrote to memory of 1244 816 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb3c7e32f84d7720ca78e9bfc7f8224.dll,#11⤵PID:1244
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb3c7e32f84d7720ca78e9bfc7f8224.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:816