Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
257s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10/06/2023, 04:47
Behavioral task
behavioral1
Sample
52b288c375cba1fa7bdcd0226d5216f8007686320fa1659f4a254c4cbb1826bd.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
52b288c375cba1fa7bdcd0226d5216f8007686320fa1659f4a254c4cbb1826bd.dll
Resource
win10-20230220-en
General
-
Target
52b288c375cba1fa7bdcd0226d5216f8007686320fa1659f4a254c4cbb1826bd.dll
-
Size
3.2MB
-
MD5
daaa8005c664f5182738dad0e5b21710
-
SHA1
41d6fd0fe049bac96c458b8af37f6d1d3f66cb44
-
SHA256
52b288c375cba1fa7bdcd0226d5216f8007686320fa1659f4a254c4cbb1826bd
-
SHA512
e35238582ceea2b745752fd74141561855e48de6ab709f3b059e1159067b1f2b64b9faa5e99aa04835fe951fc8f8fc2cd130d45d6268dda58cbcc2ce33636198
-
SSDEEP
49152:1e1wpeOJWecU4zkidgl8xoTFQY/LsA+vR2QLxpghKp0EPfp2RSTjxtd4O:tFJ7cUkPdOusDGQKp7PN/x4O
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 1 2032 rundll32.exe -
resource yara_rule behavioral1/memory/2032-54-0x0000000010000000-0x00000000104BB000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2032 2016 rundll32.exe 27 PID 2016 wrote to memory of 2032 2016 rundll32.exe 27 PID 2016 wrote to memory of 2032 2016 rundll32.exe 27 PID 2016 wrote to memory of 2032 2016 rundll32.exe 27 PID 2016 wrote to memory of 2032 2016 rundll32.exe 27 PID 2016 wrote to memory of 2032 2016 rundll32.exe 27 PID 2016 wrote to memory of 2032 2016 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52b288c375cba1fa7bdcd0226d5216f8007686320fa1659f4a254c4cbb1826bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52b288c375cba1fa7bdcd0226d5216f8007686320fa1659f4a254c4cbb1826bd.dll,#12⤵
- Blocklisted process makes network request
PID:2032
-