Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 12:05
Behavioral task
behavioral1
Sample
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll
Resource
win10v2004-20220901-en
General
-
Target
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll
-
Size
21KB
-
MD5
0ce143cda2bb97b2b00c840a9b8b71d8
-
SHA1
cd05b365ca0b6d6b9ad25f9180cbc35ef6b369c7
-
SHA256
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e
-
SHA512
f2f447db3763228b23c4485434905ddb8e52d8906a8ef781c4127f3360abff5f74406b07e6efba5fbf37c039c2bb1424a95971db082329f7c53830481e9dfb0d
-
SSDEEP
384:9w2fzhxC+iyYBx6jJejpTymN6TrydVuNN9fGFDnjkMcRfEVn4pLhd+pvq1n:621xCXhx6YjV6XwVo+F7wRfWELhdwq
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 896 rundll32.exe -
resource yara_rule behavioral1/memory/896-56-0x0000000071000000-0x0000000071019000-memory.dmp upx behavioral1/memory/896-57-0x0000000071000000-0x0000000071019000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\smss.dll rundll32.exe File created C:\Windows\SysWOW64\WLanAdapter.sys rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 896 rundll32.exe 896 rundll32.exe 896 rundll32.exe 896 rundll32.exe 896 rundll32.exe 896 rundll32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1084 wrote to memory of 896 1084 rundll32.exe 27 PID 1084 wrote to memory of 896 1084 rundll32.exe 27 PID 1084 wrote to memory of 896 1084 rundll32.exe 27 PID 1084 wrote to memory of 896 1084 rundll32.exe 27 PID 1084 wrote to memory of 896 1084 rundll32.exe 27 PID 1084 wrote to memory of 896 1084 rundll32.exe 27 PID 1084 wrote to memory of 896 1084 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll,#12⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:896
-