Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
eb91545aaafaceae5d78d1c186e87cd45388fc93ac3fabad08dfcf79e3ef7a40.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
eb91545aaafaceae5d78d1c186e87cd45388fc93ac3fabad08dfcf79e3ef7a40.dll
Resource
win10v2004-20240704-en
General
-
Target
eb91545aaafaceae5d78d1c186e87cd45388fc93ac3fabad08dfcf79e3ef7a40.dll
-
Size
3.4MB
-
MD5
dbc37ba7858d06ce1641e83b18d588f9
-
SHA1
5ba29d88000abfff77f5bafe79dcaae9730ffa2b
-
SHA256
eb91545aaafaceae5d78d1c186e87cd45388fc93ac3fabad08dfcf79e3ef7a40
-
SHA512
301b2fe14f0c20ffa6462ac529bc41276ba7ee63acea263a50f2ec2bab3386de82ff83500b61a6316587815c5fc3d9dc532b10e480fa567ae5046fd45f4ef665
-
SSDEEP
12288:IteVGceT09MzaXPrMGpmcVKoKNGpCZl+9c1N9ASW/RE30Y3yGRhmrp6pxuZ0HlsE:iBcZ9Mza4GEN+m1N9AB230MRtTuCCc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2208 2336 rundll32.exe 30 PID 2336 wrote to memory of 2208 2336 rundll32.exe 30 PID 2336 wrote to memory of 2208 2336 rundll32.exe 30 PID 2336 wrote to memory of 2208 2336 rundll32.exe 30 PID 2336 wrote to memory of 2208 2336 rundll32.exe 30 PID 2336 wrote to memory of 2208 2336 rundll32.exe 30 PID 2336 wrote to memory of 2208 2336 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb91545aaafaceae5d78d1c186e87cd45388fc93ac3fabad08dfcf79e3ef7a40.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb91545aaafaceae5d78d1c186e87cd45388fc93ac3fabad08dfcf79e3ef7a40.dll,#12⤵PID:2208
-