Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 12:05
Behavioral task
behavioral1
Sample
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll
-
Size
21KB
-
MD5
0ce143cda2bb97b2b00c840a9b8b71d8
-
SHA1
cd05b365ca0b6d6b9ad25f9180cbc35ef6b369c7
-
SHA256
f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e
-
SHA512
f2f447db3763228b23c4485434905ddb8e52d8906a8ef781c4127f3360abff5f74406b07e6efba5fbf37c039c2bb1424a95971db082329f7c53830481e9dfb0d
-
SSDEEP
384:9w2fzhxC+iyYBx6jJejpTymN6TrydVuNN9fGFDnjkMcRfEVn4pLhd+pvq1n:621xCXhx6YjV6XwVo+F7wRfWELhdwq
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 15 2500 rundll32.exe 15 2500 rundll32.exe 15 2500 rundll32.exe 15 2500 rundll32.exe 15 2500 rundll32.exe 15 2500 rundll32.exe -
resource yara_rule behavioral2/memory/2500-133-0x0000000071000000-0x0000000071019000-memory.dmp upx behavioral2/memory/2500-134-0x0000000071000000-0x0000000071019000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\WLanAdapter.sys rundll32.exe File created C:\Windows\SysWOW64\smss.dll rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2500 5064 rundll32.exe 81 PID 5064 wrote to memory of 2500 5064 rundll32.exe 81 PID 5064 wrote to memory of 2500 5064 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f73da3a552be3022e7aa6538d31f43d6b410d6083cf48a895f408df660a89e.dll,#12⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2500
-