Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll
Resource
win10v2004-20221111-en
General
-
Target
c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll
-
Size
20KB
-
MD5
992f77c3ec4aa10a245f6614c9499573
-
SHA1
d42ab0987affc0c6c5b16569972efa810db1eb0a
-
SHA256
c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1
-
SHA512
cd403d55ca3e6e98358c73c2d663c9a8bde4e2f6f38d69e7aac536873d1e8452f90fd6502eb73819fd132c0a5ddc2c2492a0df6b9ce8cc4a776a960208995cf5
-
SSDEEP
384:zSG/2Jp+C6QhtmruxCcdIL+0XpliCAu8UaWHuqaTlX0wG:zfYh2oCtpXPix2OqaewG
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2008 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2008 1076 rundll32.exe 28 PID 1076 wrote to memory of 2008 1076 rundll32.exe 28 PID 1076 wrote to memory of 2008 1076 rundll32.exe 28 PID 1076 wrote to memory of 2008 1076 rundll32.exe 28 PID 1076 wrote to memory of 2008 1076 rundll32.exe 28 PID 1076 wrote to memory of 2008 1076 rundll32.exe 28 PID 1076 wrote to memory of 2008 1076 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll,#12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5117f16351b445084b858ae674c318fd8
SHA147ca3021104d7dbe5543d06d3e07855155f879d3
SHA2567ccdfae499703257e3ef2638ede2ef98297a87ad5866f028c8afe28756a77b22
SHA51241ffd45a75d6add2c0f20a38ab9f7290484c357d343e838111471ab73a172e43fff3d994ac23ec5c2baa11c261f45dbdfad814866144d98a56159d087bd701ad