Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05/02/2022, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
1130c38b05892129ef1a97693b0d3797a45ec69fe0d95bc28e4b09e3d4dd0e9c.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1130c38b05892129ef1a97693b0d3797a45ec69fe0d95bc28e4b09e3d4dd0e9c.dll
Resource
win10v2004-en-20220112
General
-
Target
1130c38b05892129ef1a97693b0d3797a45ec69fe0d95bc28e4b09e3d4dd0e9c.dll
-
Size
834KB
-
MD5
9655fcc96226cc1c9b6190f154a03066
-
SHA1
33e65f6a0a939efe5c899bcd025609fa8b43d0bc
-
SHA256
1130c38b05892129ef1a97693b0d3797a45ec69fe0d95bc28e4b09e3d4dd0e9c
-
SHA512
26ff6450786373fa654244900ce3147c171217d64dcc814a2df49616a227e94e53b91ad08e012cc952f03873959e6d482afdd5553e9a97422f6317be37719ab9
Malware Config
Extracted
zloader
main
23.04.2020
https://coult.org/sound.php
https://tilyn.org/sound.php
https://rhald.org/sound.php
https://rutom.org/sound.php
https://chorbly.org/sound.php
https://kodray.org/sound.php
-
build_id
45
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1400 1436 rundll32.exe 27 PID 1436 wrote to memory of 1400 1436 rundll32.exe 27 PID 1436 wrote to memory of 1400 1436 rundll32.exe 27 PID 1436 wrote to memory of 1400 1436 rundll32.exe 27 PID 1436 wrote to memory of 1400 1436 rundll32.exe 27 PID 1436 wrote to memory of 1400 1436 rundll32.exe 27 PID 1436 wrote to memory of 1400 1436 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1130c38b05892129ef1a97693b0d3797a45ec69fe0d95bc28e4b09e3d4dd0e9c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1130c38b05892129ef1a97693b0d3797a45ec69fe0d95bc28e4b09e3d4dd0e9c.dll,#12⤵PID:1400
-