Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 21:11 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0287f25c692276c3c430015213dedbe4.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0287f25c692276c3c430015213dedbe4.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
0287f25c692276c3c430015213dedbe4.dll
-
Size
81KB
-
MD5
0287f25c692276c3c430015213dedbe4
-
SHA1
db13c64ef86ed8a17c2a61a6412d06a9db9fdb5e
-
SHA256
1674cdf1ed97bdae91c984ee0e85f624d67feadad78e02b8c2f392e7587ab9e4
-
SHA512
950eb51651808dd537f53a554e8e985575c351014daf919d0a04871a0087d7b43c3c98898b480c6f6743ca22c6d0728b73b269a8da9921e70a178d20774a19d6
-
SSDEEP
1536:Zc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GV:O+5oxmqAiR8+/RBkez0U+6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2656 2824 rundll32.exe 29 PID 2824 wrote to memory of 2656 2824 rundll32.exe 29 PID 2824 wrote to memory of 2656 2824 rundll32.exe 29 PID 2824 wrote to memory of 2656 2824 rundll32.exe 29 PID 2824 wrote to memory of 2656 2824 rundll32.exe 29 PID 2824 wrote to memory of 2656 2824 rundll32.exe 29 PID 2824 wrote to memory of 2656 2824 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0287f25c692276c3c430015213dedbe4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0287f25c692276c3c430015213dedbe4.dll,#12⤵PID:2656
-