Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
Resource
win10v2004-20240704-en
General
-
Target
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
-
Size
20KB
-
MD5
d1ce027186875abb6276c3c728ebc608
-
SHA1
a4ec7cf604b466079395c8a4b80bfcc7274f18a1
-
SHA256
07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2
-
SHA512
418458c102cf3be56c0fb46c2899b52c60922974bccec8d22113ebde3b747ab143e20d4a9dc494184f623803009f7c6f14f7e1907fea14a0de65928d9796d9f5
-
SSDEEP
96:X908s82LTQTLnOU19Fi6kITearYEoosuvV/O:t08n2fQ/P1QIqajoosk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3032 2864 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2864 2336 rundll32.exe 30 PID 2336 wrote to memory of 2864 2336 rundll32.exe 30 PID 2336 wrote to memory of 2864 2336 rundll32.exe 30 PID 2336 wrote to memory of 2864 2336 rundll32.exe 30 PID 2336 wrote to memory of 2864 2336 rundll32.exe 30 PID 2336 wrote to memory of 2864 2336 rundll32.exe 30 PID 2336 wrote to memory of 2864 2336 rundll32.exe 30 PID 2864 wrote to memory of 3032 2864 rundll32.exe 31 PID 2864 wrote to memory of 3032 2864 rundll32.exe 31 PID 2864 wrote to memory of 3032 2864 rundll32.exe 31 PID 2864 wrote to memory of 3032 2864 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 2283⤵
- Program crash
PID:3032
-
-