Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
206s -
max time network
215s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 05:03
Behavioral task
behavioral1
Sample
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll
-
Size
701KB
-
MD5
37e927d1822f3754edf93669ba2b96c0
-
SHA1
0cbff93be9f7a11781d4e71fb8520168b481338b
-
SHA256
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60
-
SHA512
56e432d997e0e59692ff154197a8eb330a00d2873f5f1b7e8f73675ca341f569f311e3ad5f9589b714929042c495849b34b3c2d74df9c589a6ed517e1e199ac2
-
SSDEEP
12288:IiTAZSaeC0bAKAWwmgFVPreOeM2WmQw3jKX8/PKXB:xTdQcAKAW3UrefM2WmQIsgK
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 3 292 rundll32.exe 4 292 rundll32.exe 5 292 rundll32.exe 6 292 rundll32.exe 7 292 rundll32.exe 8 292 rundll32.exe 9 292 rundll32.exe 10 292 rundll32.exe 11 292 rundll32.exe 12 292 rundll32.exe 13 292 rundll32.exe 14 292 rundll32.exe 15 292 rundll32.exe 16 292 rundll32.exe 17 292 rundll32.exe 18 292 rundll32.exe 19 292 rundll32.exe 20 292 rundll32.exe 21 292 rundll32.exe 22 292 rundll32.exe 23 292 rundll32.exe 24 292 rundll32.exe 25 292 rundll32.exe 26 292 rundll32.exe 27 292 rundll32.exe 28 292 rundll32.exe 29 292 rundll32.exe 30 292 rundll32.exe 31 292 rundll32.exe 32 292 rundll32.exe 33 292 rundll32.exe 34 292 rundll32.exe 35 292 rundll32.exe 36 292 rundll32.exe 37 292 rundll32.exe 38 292 rundll32.exe 39 292 rundll32.exe 40 292 rundll32.exe 41 292 rundll32.exe 42 292 rundll32.exe 43 292 rundll32.exe 44 292 rundll32.exe 45 292 rundll32.exe 48 292 rundll32.exe 49 292 rundll32.exe 50 292 rundll32.exe 51 292 rundll32.exe 52 292 rundll32.exe 53 292 rundll32.exe 54 292 rundll32.exe 55 292 rundll32.exe 56 292 rundll32.exe 57 292 rundll32.exe 58 292 rundll32.exe 59 292 rundll32.exe 60 292 rundll32.exe 61 292 rundll32.exe 62 292 rundll32.exe 63 292 rundll32.exe 64 292 rundll32.exe 65 292 rundll32.exe 66 292 rundll32.exe 67 292 rundll32.exe 68 292 rundll32.exe -
resource yara_rule behavioral1/memory/292-56-0x00000000002E0000-0x0000000000391000-memory.dmp upx behavioral1/memory/292-57-0x00000000002E0000-0x0000000000391000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2024 wrote to memory of 292 2024 rundll32.exe 28 PID 2024 wrote to memory of 292 2024 rundll32.exe 28 PID 2024 wrote to memory of 292 2024 rundll32.exe 28 PID 2024 wrote to memory of 292 2024 rundll32.exe 28 PID 2024 wrote to memory of 292 2024 rundll32.exe 28 PID 2024 wrote to memory of 292 2024 rundll32.exe 28 PID 2024 wrote to memory of 292 2024 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll,#12⤵
- Blocklisted process makes network request
PID:292
-