Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
c3b04838c4fd7cb1ac271a2cf72c3eb6ac40781fc0400dcbec74bd5d95d904e9.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
c3b04838c4fd7cb1ac271a2cf72c3eb6ac40781fc0400dcbec74bd5d95d904e9.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
c3b04838c4fd7cb1ac271a2cf72c3eb6ac40781fc0400dcbec74bd5d95d904e9.dll
-
Size
64KB
-
MD5
2f0dba0e1be75a8232f3baf9d36efb42
-
SHA1
7a3fc0993eed9ef4cfd2a81a704cfefd43d009e5
-
SHA256
c3b04838c4fd7cb1ac271a2cf72c3eb6ac40781fc0400dcbec74bd5d95d904e9
-
SHA512
d3e106314a782714cb7be604d109d39029a780a6e918bca98eea10c0129cef0a78a4308094ef1dcb9bc477b6d864fb23a45396d4ff087b1e6832f00437de0f25
-
SSDEEP
1536:YePTkZKUT5qq2hu0TgzP5bbT8vqtdJ6UtaCj:Yeol0huh4CtjLtaCj
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1216 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1824 wrote to memory of 1216 1824 rundll32.exe 28 PID 1824 wrote to memory of 1216 1824 rundll32.exe 28 PID 1824 wrote to memory of 1216 1824 rundll32.exe 28 PID 1824 wrote to memory of 1216 1824 rundll32.exe 28 PID 1824 wrote to memory of 1216 1824 rundll32.exe 28 PID 1824 wrote to memory of 1216 1824 rundll32.exe 28 PID 1824 wrote to memory of 1216 1824 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3b04838c4fd7cb1ac271a2cf72c3eb6ac40781fc0400dcbec74bd5d95d904e9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3b04838c4fd7cb1ac271a2cf72c3eb6ac40781fc0400dcbec74bd5d95d904e9.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1216
-