Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
7030c776d347ee3d99a1e46047e7ee950536f532020f4febf37e48e71ff8e26d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7030c776d347ee3d99a1e46047e7ee950536f532020f4febf37e48e71ff8e26d.dll
Resource
win10v2004-20240226-en
General
-
Target
7030c776d347ee3d99a1e46047e7ee950536f532020f4febf37e48e71ff8e26d.dll
-
Size
122KB
-
MD5
df6b1b23e7a986efa74126e843e63ac4
-
SHA1
42e8a8445cf92066622490641e8642ab3016f3fe
-
SHA256
7030c776d347ee3d99a1e46047e7ee950536f532020f4febf37e48e71ff8e26d
-
SHA512
c94268d392c60f8bb0c9d8b90b02b409be1fe2587c164def91bfa0f98d9796b360dd0075ac7bcfcba6a93b9fe851f166d2d2c67bcd8615fce1be99ef83a35aef
-
SSDEEP
3072:m3f5n0R9aOt3HQpiVyk2lQBV+UdE+rECWp7hKvm:YR0+Ot3U+BV+UdvrEFp7hKvm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2920 wrote to memory of 1812 2920 rundll32.exe 28 PID 2920 wrote to memory of 1812 2920 rundll32.exe 28 PID 2920 wrote to memory of 1812 2920 rundll32.exe 28 PID 2920 wrote to memory of 1812 2920 rundll32.exe 28 PID 2920 wrote to memory of 1812 2920 rundll32.exe 28 PID 2920 wrote to memory of 1812 2920 rundll32.exe 28 PID 2920 wrote to memory of 1812 2920 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7030c776d347ee3d99a1e46047e7ee950536f532020f4febf37e48e71ff8e26d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7030c776d347ee3d99a1e46047e7ee950536f532020f4febf37e48e71ff8e26d.dll,#12⤵PID:1812
-