Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
8a105c940cebbaf52f2cf2db8a4eaae547d08631c1f335bd9c5ef30c35f8970d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8a105c940cebbaf52f2cf2db8a4eaae547d08631c1f335bd9c5ef30c35f8970d.dll
Resource
win10v2004-20221111-en
General
-
Target
8a105c940cebbaf52f2cf2db8a4eaae547d08631c1f335bd9c5ef30c35f8970d.dll
-
Size
336KB
-
MD5
7f773a696966170f48a4f1400771d0a9
-
SHA1
5fd87624b83077607847a0a2f3e6acf350db8d25
-
SHA256
8a105c940cebbaf52f2cf2db8a4eaae547d08631c1f335bd9c5ef30c35f8970d
-
SHA512
b6caf9fed3e1a2750b99105893b8ec9b1d8de17b3c9e5432d92e4a969ac81971ab1f290fb323ea817f68d2c4723847ddbfd496b946245cc9935d179854da403e
-
SSDEEP
6144:jm4oIa8Ik5u0/EqPAHQes1gP89l9xMVZ+9+JFw:jVtaPksNqPAHY1FxMe+U
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1936 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1936 AUDIODG.EXE Token: 33 1936 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1936 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1372 1348 rundll32.exe 26 PID 1348 wrote to memory of 1372 1348 rundll32.exe 26 PID 1348 wrote to memory of 1372 1348 rundll32.exe 26 PID 1348 wrote to memory of 1372 1348 rundll32.exe 26 PID 1348 wrote to memory of 1372 1348 rundll32.exe 26 PID 1348 wrote to memory of 1372 1348 rundll32.exe 26 PID 1348 wrote to memory of 1372 1348 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8a105c940cebbaf52f2cf2db8a4eaae547d08631c1f335bd9c5ef30c35f8970d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8a105c940cebbaf52f2cf2db8a4eaae547d08631c1f335bd9c5ef30c35f8970d.dll,#12⤵PID:1372
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x47c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936