Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 13:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3db86ff8ec6a30e07ad7830d8663ef7.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3db86ff8ec6a30e07ad7830d8663ef7.dll
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
a3db86ff8ec6a30e07ad7830d8663ef7.dll
-
Size
1005KB
-
MD5
a3db86ff8ec6a30e07ad7830d8663ef7
-
SHA1
41b669a530f9cb2a3a140bc6037f3292ef066b9e
-
SHA256
c40dd0364e3b327849c68139e072db09b5f71ab38a8526865c47766a61f2364f
-
SHA512
53f1bee877ca947458cd547c69ee73351e25e5a9dd86a0e45a765025f59d1eb221dd5f3f24fe20bd11dc9d179f50df5c3d319c090fc2b990b8fa15f48e2e5807
-
SSDEEP
3072:TQuZG/ZMiE61ouqY7dtACZrzNp/c3Wh4CyPuf5Vlxl+ROXReazAOF/uIAPX2hjik:EESt3rg3s4CyPuffLvseT/uZ4ji8CA5
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2968 2292 rundll32.exe 28 PID 2292 wrote to memory of 2968 2292 rundll32.exe 28 PID 2292 wrote to memory of 2968 2292 rundll32.exe 28 PID 2292 wrote to memory of 2968 2292 rundll32.exe 28 PID 2292 wrote to memory of 2968 2292 rundll32.exe 28 PID 2292 wrote to memory of 2968 2292 rundll32.exe 28 PID 2292 wrote to memory of 2968 2292 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#12⤵PID:2968
-