Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
1MDE_File_S...17.zip
windows7-x64
1MDE_File_S...17.zip
windows10-2004-x64
1Download-S...in.zip
windows7-x64
1Download-S...in.zip
windows10-2004-x64
1Download-S...14.zip
windows7-x64
1Download-S...14.zip
windows10-2004-x64
1run-ryr.dll
windows7-x64
1run-ryr.dll
windows10-2004-x64
1Analysis
-
max time kernel
36s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03/03/2023, 13:50 UTC
Static task
static1
Behavioral task
behavioral1
Sample
MDE_File_Sample_46e61f1223e9d32122dd447e9b20cbc3ad208517.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MDE_File_Sample_46e61f1223e9d32122dd447e9b20cbc3ad208517.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Download-Setup-57-main.zip
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Download-Setup-57-main.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Download-Setup-57-main/sfx_123_414.zip
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Download-Setup-57-main/sfx_123_414.zip
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
run-ryr.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
run-ryr.dll
Resource
win10v2004-20230220-en
General
-
Target
run-ryr.dll
-
Size
681.6MB
-
MD5
d1330647cc11d5701c256235d28b638a
-
SHA1
7960267d504734f6b347ece388379d86c1abf963
-
SHA256
b0ab4914069e7b540932e416d0e0a836b77fc1392a65bbc7fa79acca3e0b00b0
-
SHA512
05bdbf39d866d6f6eae6fd35df5aabde72b952d6c49c73f9ebec50b1e5fb9fde565cf93172f4acb547213457a11888669f1926125243370a7d308271f45d3f51
-
SSDEEP
24576:rRLskQ4zPr36G53wMocCDtm1mwqww+PtZ7xOgm8UOn3IVMF0:rRLg4vrboXxmLqwftZso58r
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2008 1996 rundll32.exe 28 PID 1996 wrote to memory of 2008 1996 rundll32.exe 28 PID 1996 wrote to memory of 2008 1996 rundll32.exe 28 PID 1996 wrote to memory of 2008 1996 rundll32.exe 28 PID 1996 wrote to memory of 2008 1996 rundll32.exe 28 PID 1996 wrote to memory of 2008 1996 rundll32.exe 28 PID 1996 wrote to memory of 2008 1996 rundll32.exe 28