Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 10:52

General

  • Target

    69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll

  • Size

    141KB

  • MD5

    3b1c5ffc45a703a7081d17ab57846c80

  • SHA1

    4417b320106a138cfe8660c7d31a901e326fb535

  • SHA256

    69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd

  • SHA512

    49d0f8d4813525609c8060a2c7e1a470f026cc944414990049d925421188059306cbfc07233183919fa42e29141b2ceea4f9bbfe017bf4422248e27028f67e28

  • SSDEEP

    1536:VOzMIXh3CrmyOrRFoRKD5UP0YSSz0K+SKZ9kdF0P6fFSa+rdWigqksTGnDgSG+3:VEFh3PyOrRqRlP0K+XZ9gRUksCnsE3

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\69f9f26f0c1995d706b0a5f29dc480b56660e91f9bb049045f54187ef01617fd.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        PID:976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\rundll32mgr.exe

    Filesize

    132KB

    MD5

    cbd38d234814dc2b368a90a57e0b8ec1

    SHA1

    648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

    SHA256

    f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

    SHA512

    7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    132KB

    MD5

    cbd38d234814dc2b368a90a57e0b8ec1

    SHA1

    648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

    SHA256

    f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

    SHA512

    7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    132KB

    MD5

    cbd38d234814dc2b368a90a57e0b8ec1

    SHA1

    648ea0a1598ab0c1d91e1f45157b5ca6a6bc1dc4

    SHA256

    f761a2068bfd80d7bb1e9ccd6cca47be2952fa641b85494cbabbd336d4f2d786

    SHA512

    7866a0c6b7bcc272428062e744873a4457a5519a5731e377ecc661e76051bb5078b8c04c804816c847dc4964033893bea7f6815b9febb26f8d00a20157a0bab2

  • memory/976-60-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1652-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

    Filesize

    8KB