Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12/10/2022, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
scoffed.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
scoffed.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
300 seconds
General
-
Target
scoffed.dll
-
Size
743KB
-
MD5
861f0031d6adde4ea8fe681fe1d6070a
-
SHA1
271c79a71423236dfaf109adce20efb0bbcc010a
-
SHA256
cedb23903ff7b26d31fc437c0747f0fc2c57aab62ff14b58f9b47c81b88c9a86
-
SHA512
1fc8ec236475d0b75fe9704e5a1b9d456f58b84dd3c272e40a9f09f583aa47393ddbbfa9d7fb6bcd377adaa13d313241ce5a28214b85f58f7774ee7f1bd01a2c
-
SSDEEP
12288:e+4QHixeljmtjVFJcPp+cygICZoxlSr9N6q6xMZXJMeGbX//7OT:5DXjmtjVD3cygICZwSJN6q6yZXJM5T/c
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1364 rundll32.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe 944 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1364 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1364 1996 rundll32.exe 28 PID 1996 wrote to memory of 1364 1996 rundll32.exe 28 PID 1996 wrote to memory of 1364 1996 rundll32.exe 28 PID 1996 wrote to memory of 1364 1996 rundll32.exe 28 PID 1996 wrote to memory of 1364 1996 rundll32.exe 28 PID 1996 wrote to memory of 1364 1996 rundll32.exe 28 PID 1996 wrote to memory of 1364 1996 rundll32.exe 28 PID 1364 wrote to memory of 944 1364 rundll32.exe 29 PID 1364 wrote to memory of 944 1364 rundll32.exe 29 PID 1364 wrote to memory of 944 1364 rundll32.exe 29 PID 1364 wrote to memory of 944 1364 rundll32.exe 29 PID 1364 wrote to memory of 944 1364 rundll32.exe 29 PID 1364 wrote to memory of 944 1364 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scoffed.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scoffed.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:944
-
-