Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
21a0988c3545a7f4b3d45ba93a0c563e90cd98d5c3b1f4121ee580ec6d001a76.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21a0988c3545a7f4b3d45ba93a0c563e90cd98d5c3b1f4121ee580ec6d001a76.dll
Resource
win10v2004-20240508-en
General
-
Target
21a0988c3545a7f4b3d45ba93a0c563e90cd98d5c3b1f4121ee580ec6d001a76.dll
-
Size
37KB
-
MD5
c302f97a201f5b928fe47a5f57484be0
-
SHA1
e1e6949347c90dcba58145e1e4e4809c7bd77fdc
-
SHA256
21a0988c3545a7f4b3d45ba93a0c563e90cd98d5c3b1f4121ee580ec6d001a76
-
SHA512
eda58ac327b1affb4de10aab356b94f37a9348280925c6684a68bcc95e5227ff0ecca651493409a175cdd27c2bb7bfb458e85a3c0857908ca05ba2e6872da86e
-
SSDEEP
768:RfEiGQv5NGcI7hXMQY0ED4QnkBpy73tdv:yi9vnw/7GR79dv
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2012 2104 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2104 3024 rundll32.exe 28 PID 3024 wrote to memory of 2104 3024 rundll32.exe 28 PID 3024 wrote to memory of 2104 3024 rundll32.exe 28 PID 3024 wrote to memory of 2104 3024 rundll32.exe 28 PID 3024 wrote to memory of 2104 3024 rundll32.exe 28 PID 3024 wrote to memory of 2104 3024 rundll32.exe 28 PID 3024 wrote to memory of 2104 3024 rundll32.exe 28 PID 2104 wrote to memory of 2012 2104 rundll32.exe 29 PID 2104 wrote to memory of 2012 2104 rundll32.exe 29 PID 2104 wrote to memory of 2012 2104 rundll32.exe 29 PID 2104 wrote to memory of 2012 2104 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21a0988c3545a7f4b3d45ba93a0c563e90cd98d5c3b1f4121ee580ec6d001a76.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21a0988c3545a7f4b3d45ba93a0c563e90cd98d5c3b1f4121ee580ec6d001a76.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 2203⤵
- Program crash
PID:2012
-
-