Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll
Resource
win10v2004-20240226-en
General
-
Target
fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll
-
Size
81KB
-
MD5
fbf6559769a9ae1165e0d37c6d14f54e
-
SHA1
7ba7508a0751522e30df5377c58cd61d24aa3d93
-
SHA256
fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b
-
SHA512
0fc1921fcd256c2c7461ede766f606f1b72092a563c67769fd63e03c41ba99ee6780ed2df9a86e1dbdf4f7f1069d3873b7496f281fb9f6dd3c47b8178a45cc19
-
SSDEEP
1536:cc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GH:z+5oxmqAiR8+/RBkez0U+c
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1632 2368 rundll32.exe 28 PID 2368 wrote to memory of 1632 2368 rundll32.exe 28 PID 2368 wrote to memory of 1632 2368 rundll32.exe 28 PID 2368 wrote to memory of 1632 2368 rundll32.exe 28 PID 2368 wrote to memory of 1632 2368 rundll32.exe 28 PID 2368 wrote to memory of 1632 2368 rundll32.exe 28 PID 2368 wrote to memory of 1632 2368 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll,#12⤵PID:1632
-