Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
a484d264916bfdd57631f15e987d8ddaae98daac5daf62a70081d12ab4fec533.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a484d264916bfdd57631f15e987d8ddaae98daac5daf62a70081d12ab4fec533.dll
Resource
win10v2004-20231215-en
General
-
Target
a484d264916bfdd57631f15e987d8ddaae98daac5daf62a70081d12ab4fec533.dll
-
Size
46KB
-
MD5
dbad6b495cd89250fa8570859bfe4dcd
-
SHA1
1c70ccead809c792b35780d831e7ce123eaf0f68
-
SHA256
a484d264916bfdd57631f15e987d8ddaae98daac5daf62a70081d12ab4fec533
-
SHA512
642b9fb58f0b7de193fe7a7cb6874b3f375c79640bed33cb9b3cda1f780c56d081449899cf4e433c8c5a15a9546bb95d84e4df363479bbc33942ce987c901d5e
-
SSDEEP
768:muywzQxeL1kkidp8pyfkoqhHNOVpZSAq3O6w0:/Qxssp8pyfXqhkVqAb6w
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2212 1304 rundll32.exe 28 PID 1304 wrote to memory of 2212 1304 rundll32.exe 28 PID 1304 wrote to memory of 2212 1304 rundll32.exe 28 PID 1304 wrote to memory of 2212 1304 rundll32.exe 28 PID 1304 wrote to memory of 2212 1304 rundll32.exe 28 PID 1304 wrote to memory of 2212 1304 rundll32.exe 28 PID 1304 wrote to memory of 2212 1304 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a484d264916bfdd57631f15e987d8ddaae98daac5daf62a70081d12ab4fec533.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a484d264916bfdd57631f15e987d8ddaae98daac5daf62a70081d12ab4fec533.dll,#12⤵PID:2212
-