Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 07:00
Behavioral task
behavioral1
Sample
968e747dc48491d9d608c6a5dbeab189.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
968e747dc48491d9d608c6a5dbeab189.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
968e747dc48491d9d608c6a5dbeab189.dll
-
Size
96KB
-
MD5
968e747dc48491d9d608c6a5dbeab189
-
SHA1
495bdd375127eb3441eb4c8fc802bcaa0ee86afb
-
SHA256
a4f6cf6d98e9bf6cde204d1161a9e751951387e86d371ecdc25773a729b086d7
-
SHA512
53a711279f0c7ec8603a6443a13647521451f3c0c5a39638997f6913828b33af7fef07b6bdc8651cf6cbd63c81d046691b2e650667bf41165d880f8bdaf27558
-
SSDEEP
1536:SAVJ0mWeB/iU9tdbCUSlqYaDv3aqB81RKH2HLa6NtKMWmHgWqeIBCiKt:zJ0mW8/iUBClqYarqqBkvNGFDCrt
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1876 1888 rundll32.exe 28 PID 1888 wrote to memory of 1876 1888 rundll32.exe 28 PID 1888 wrote to memory of 1876 1888 rundll32.exe 28 PID 1888 wrote to memory of 1876 1888 rundll32.exe 28 PID 1888 wrote to memory of 1876 1888 rundll32.exe 28 PID 1888 wrote to memory of 1876 1888 rundll32.exe 28 PID 1888 wrote to memory of 1876 1888 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\968e747dc48491d9d608c6a5dbeab189.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\968e747dc48491d9d608c6a5dbeab189.dll,#12⤵PID:1876
-