Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll
Resource
win10v2004-20220812-en
General
-
Target
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll
-
Size
305KB
-
MD5
286a7107c09b0f8c0a98470f18658f59
-
SHA1
7d53536cd5af8a5ed75f1da8567218daf4744881
-
SHA256
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c
-
SHA512
99177b0888696837dad034a985dbfdaec70c9e829e9de4f9fd99c1ed93462d7d8be507fe5d7720e3425d259ce1afd433238c90426c36181dc0e2dfc88569384d
-
SSDEEP
6144:huBFnY78dgeBp6YMTE7q6Eru9DM5A2EMc5vwqrb:wHnO8dgeB6Th6bJM5mMc5Xb
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 896 wrote to memory of 1088 896 rundll32.exe 28 PID 896 wrote to memory of 1088 896 rundll32.exe 28 PID 896 wrote to memory of 1088 896 rundll32.exe 28 PID 896 wrote to memory of 1088 896 rundll32.exe 28 PID 896 wrote to memory of 1088 896 rundll32.exe 28 PID 896 wrote to memory of 1088 896 rundll32.exe 28 PID 896 wrote to memory of 1088 896 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1088
-