Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02/12/2022, 22:51

General

  • Target

    c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll

  • Size

    20KB

  • MD5

    992f77c3ec4aa10a245f6614c9499573

  • SHA1

    d42ab0987affc0c6c5b16569972efa810db1eb0a

  • SHA256

    c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1

  • SHA512

    cd403d55ca3e6e98358c73c2d663c9a8bde4e2f6f38d69e7aac536873d1e8452f90fd6502eb73819fd132c0a5ddc2c2492a0df6b9ce8cc4a776a960208995cf5

  • SSDEEP

    384:zSG/2Jp+C6QhtmruxCcdIL+0XpliCAu8UaWHuqaTlX0wG:zfYh2oCtpXPix2OqaewG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll,#1
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\9020.tmp

    Filesize

    20KB

    MD5

    117f16351b445084b858ae674c318fd8

    SHA1

    47ca3021104d7dbe5543d06d3e07855155f879d3

    SHA256

    7ccdfae499703257e3ef2638ede2ef98297a87ad5866f028c8afe28756a77b22

    SHA512

    41ffd45a75d6add2c0f20a38ab9f7290484c357d343e838111471ab73a172e43fff3d994ac23ec5c2baa11c261f45dbdfad814866144d98a56159d087bd701ad

  • memory/2008-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

    Filesize

    8KB