Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
59cd064220a8ae001f48811c60d51586c7ca7e8c3dc8cec5f975c6aa76acdf3e.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
59cd064220a8ae001f48811c60d51586c7ca7e8c3dc8cec5f975c6aa76acdf3e.dll
Resource
win10v2004-20240611-en
General
-
Target
59cd064220a8ae001f48811c60d51586c7ca7e8c3dc8cec5f975c6aa76acdf3e.dll
-
Size
193KB
-
MD5
7a3b7513d06922ecd23db268faa2ae6f
-
SHA1
e42b9da793022a8b5be8c9e5d6b2326a0dfb9a3a
-
SHA256
59cd064220a8ae001f48811c60d51586c7ca7e8c3dc8cec5f975c6aa76acdf3e
-
SHA512
e0846440242933c9b1c03787f80879183fead26d8f2a58cd8f5b2ef958e8fb6680e1ec46f0cfe670bb50a92e102c9594c9a8c577c44f37e17f78f6f41d5242b0
-
SSDEEP
3072:3c4RedVEXSmBGpZSsdl6bQmehwMwsAhAG478X56whl7dmj3kawQ5yKyZy:L4uXSxAAGehwMwF478p6m7x
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1228 2040 rundll32.exe 28 PID 2040 wrote to memory of 1228 2040 rundll32.exe 28 PID 2040 wrote to memory of 1228 2040 rundll32.exe 28 PID 2040 wrote to memory of 1228 2040 rundll32.exe 28 PID 2040 wrote to memory of 1228 2040 rundll32.exe 28 PID 2040 wrote to memory of 1228 2040 rundll32.exe 28 PID 2040 wrote to memory of 1228 2040 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59cd064220a8ae001f48811c60d51586c7ca7e8c3dc8cec5f975c6aa76acdf3e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59cd064220a8ae001f48811c60d51586c7ca7e8c3dc8cec5f975c6aa76acdf3e.dll,#12⤵PID:1228
-