Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
Resource
win10v2004-20240412-en
General
-
Target
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
-
Size
548KB
-
MD5
3182365a61692919f67a612dcfac1b24
-
SHA1
7e65586ee2c14b0ed864914d637a6682ff73b60b
-
SHA256
c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7
-
SHA512
bd701f61232ba158eed85610ce88bd960e775f35745e80d0f2a028e77927915f7410cc45fb20f70163ceff2181c8a8a9c0f292f0113c008ee17a13c9fd7cd98d
-
SSDEEP
6144:YltBsygUtAzpmWJqAiF+vAeDukzhQs1fjVcR/SnmFaB7aS7gtRHG4YSfvj7D5bN/:gttcPzhjZm3nNqmomAgiakjZQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2888 1500 rundll32.exe 28 PID 1500 wrote to memory of 2888 1500 rundll32.exe 28 PID 1500 wrote to memory of 2888 1500 rundll32.exe 28 PID 1500 wrote to memory of 2888 1500 rundll32.exe 28 PID 1500 wrote to memory of 2888 1500 rundll32.exe 28 PID 1500 wrote to memory of 2888 1500 rundll32.exe 28 PID 1500 wrote to memory of 2888 1500 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#12⤵PID:2888
-