Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
Resource
win10v2004-20221111-en
General
-
Target
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
-
Size
311KB
-
MD5
0dbf2e5fbcbc2a0f8128dac471ae1781
-
SHA1
18cc048f3dc7053f242b8c9cc4996ea7ca9b8ec1
-
SHA256
af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd
-
SHA512
7c26fe65cf712d72460d2c01c7e9bacfc23608646a516c9b0f7cff31e5f4bdc540ec5a44815e69c742f3f08fc179e68c2ef14138211a0f703f812e608b93b205
-
SSDEEP
6144:iqNG9C3ucRmzvXuQovJS0WEuE8c7eKfryJDvaLqi7LGjeOTB1VwAfAK:pNJucRmD5IJru67MaLqi76jeOT3h4K
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1236 rundll32.exe 1236 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1236 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 948 wrote to memory of 1236 948 rundll32.exe 27 PID 948 wrote to memory of 1236 948 rundll32.exe 27 PID 948 wrote to memory of 1236 948 rundll32.exe 27 PID 948 wrote to memory of 1236 948 rundll32.exe 27 PID 948 wrote to memory of 1236 948 rundll32.exe 27 PID 948 wrote to memory of 1236 948 rundll32.exe 27 PID 948 wrote to memory of 1236 948 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236
-