Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll
Resource
win10v2004-20240226-en
General
-
Target
b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll
-
Size
6KB
-
MD5
98d995b64f6cfc0547703cb60b2c4ab8
-
SHA1
4230455ade436a3800008b8c7364f3d341609b57
-
SHA256
b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8
-
SHA512
fc6c46c0b3b4e6b57635b896602d5b792aaf88e47ed3774d799b0ea3ff1aecbc972fc892d9a45f25ff56b8e35ae28c0882ce31efa2810259d493ed01511c18b8
-
SSDEEP
48:63mll5YVOa9VUX1iwbQWu0NB+BDq9J5SH:VDa9VUX9bQWtB+FqX5SH
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1568 wrote to memory of 2092 1568 rundll32.exe 28 PID 1568 wrote to memory of 2092 1568 rundll32.exe 28 PID 1568 wrote to memory of 2092 1568 rundll32.exe 28 PID 1568 wrote to memory of 2092 1568 rundll32.exe 28 PID 1568 wrote to memory of 2092 1568 rundll32.exe 28 PID 1568 wrote to memory of 2092 1568 rundll32.exe 28 PID 1568 wrote to memory of 2092 1568 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll,#12⤵PID:2092
-