Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 19:58
Static task
static1
Behavioral task
behavioral1
Sample
2c2336d7c582e0541bf060ccbd0ae8966ce48dbc4ab5550ff54b6549c7bed15b.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2c2336d7c582e0541bf060ccbd0ae8966ce48dbc4ab5550ff54b6549c7bed15b.dll
Resource
win10v2004-20240508-en
General
-
Target
2c2336d7c582e0541bf060ccbd0ae8966ce48dbc4ab5550ff54b6549c7bed15b.dll
-
Size
81KB
-
MD5
a192e92422a4193b1bf6e8e363c48323
-
SHA1
74a4e21edbd29e922b659e0c94c114793e5e7816
-
SHA256
2c2336d7c582e0541bf060ccbd0ae8966ce48dbc4ab5550ff54b6549c7bed15b
-
SHA512
2ed97e82f0285531ba01ad6932e2b1c8236f5ba0ec7ffc5f30757fa1cd6cc3630c0c069df7fa41dc47cd74fb52b43fe1e5a97455c90eadf6805fe91a076b19fc
-
SSDEEP
1536:mtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W6:m4v4JKXTx71w0ArSsXF3enq8W6
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3064 2972 rundll32.exe 28 PID 2972 wrote to memory of 3064 2972 rundll32.exe 28 PID 2972 wrote to memory of 3064 2972 rundll32.exe 28 PID 2972 wrote to memory of 3064 2972 rundll32.exe 28 PID 2972 wrote to memory of 3064 2972 rundll32.exe 28 PID 2972 wrote to memory of 3064 2972 rundll32.exe 28 PID 2972 wrote to memory of 3064 2972 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2336d7c582e0541bf060ccbd0ae8966ce48dbc4ab5550ff54b6549c7bed15b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2336d7c582e0541bf060ccbd0ae8966ce48dbc4ab5550ff54b6549c7bed15b.dll,#12⤵PID:3064
-