Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll
Resource
win10v2004-20240412-en
General
-
Target
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll
-
Size
14KB
-
MD5
896569aad24bb40db2db31a0dd646ee1
-
SHA1
00487b71a5b8f65b800d11e5038299f9f3f0c6a6
-
SHA256
5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8
-
SHA512
dfecc033a8922f49ddf53c47de8b876f1722b23d326492ac91c63fa80f486102d0b60a6f88dc610339aa92002023c7d6decb6920503ab68b17be2ada167e9e2a
-
SSDEEP
192:WLdDiW8J12YEVOEOYGGuFhZVinlYJL/eV/9NIDLTmKSZuSR:WLNifCYEMEfuh5qF/+LT9S5R
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2348 1612 rundll32.exe 28 PID 1612 wrote to memory of 2348 1612 rundll32.exe 28 PID 1612 wrote to memory of 2348 1612 rundll32.exe 28 PID 1612 wrote to memory of 2348 1612 rundll32.exe 28 PID 1612 wrote to memory of 2348 1612 rundll32.exe 28 PID 1612 wrote to memory of 2348 1612 rundll32.exe 28 PID 1612 wrote to memory of 2348 1612 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5115268aeabff93831ee874284415499cb09ace1d042788c46ce0d85894b2fa8.dll,#12⤵PID:2348
-