Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    06/08/2021, 12:18

General

  • Target

    2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll

  • Size

    160KB

  • MD5

    f782fa626b0c53d9cca2fbb29a65f23f

  • SHA1

    9fabc6c255ea94262b6339e4b5949174afd30114

  • SHA256

    2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b

  • SHA512

    2d023aa899d5025631534489c6a13de071113f36ae2ab32d53c833c749d262019f3c3bd7961f2da12753e389bab92f4bda429662dec77552a13c825258af9e18

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1876
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 224
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1184-63-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1876-60-0x0000000075561000-0x0000000075563000-memory.dmp

    Filesize

    8KB