Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/01/2023, 18:30
230131-w5xvqahf27 1031/01/2023, 18:16
230131-wwy2eshe77 331/01/2023, 17:51
230131-wfchgsbd2v 331/01/2023, 17:49
230131-wd521shd85 3Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
31/01/2023, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
Qakbot.dll
Resource
win7-20220901-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Qakbot.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
Qakbot.dll
-
Size
713KB
-
MD5
ea01b105c2c1bb90559bea2cd3df26fe
-
SHA1
cf73e2502f7976288857d81adf812b1b0c7c55d0
-
SHA256
4a990b2e48bc3a48a93ec155feb21d79201f6bf8b248ecd16367dc14bd2bce75
-
SHA512
698e72e18a4312b128989068a79869ec58a3e234e4af0516c98ccd0b839397e7bc1e534f316aa97f360dee2f9ce1bb119519010bb4566374ed333325eb84df5c
-
SSDEEP
12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1200 1272 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1740 wrote to memory of 1272 1740 rundll32.exe 27 PID 1272 wrote to memory of 1200 1272 rundll32.exe 28 PID 1272 wrote to memory of 1200 1272 rundll32.exe 28 PID 1272 wrote to memory of 1200 1272 rundll32.exe 28 PID 1272 wrote to memory of 1200 1272 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 2283⤵
- Program crash
PID:1200
-
-