Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/08/2023, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
ac3952245d3d68f496b192c9b2c5a3e7e9e22136df0fcca91e1237dfa665a975.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ac3952245d3d68f496b192c9b2c5a3e7e9e22136df0fcca91e1237dfa665a975.dll
Resource
win10v2004-20230703-en
General
-
Target
ac3952245d3d68f496b192c9b2c5a3e7e9e22136df0fcca91e1237dfa665a975.dll
-
Size
2.4MB
-
MD5
f2470442f3de8f8e0bfbc8c63115e45e
-
SHA1
01f58dd1ac7f7cb4d5120af90829ca424d20d101
-
SHA256
ac3952245d3d68f496b192c9b2c5a3e7e9e22136df0fcca91e1237dfa665a975
-
SHA512
4cbe2d49ee8eed5e5c7273c54fc7a783234b5dd4e0676641bbbfe8dbaa3f9ab70cd4073f692f2e212fea7e140989cb5c5ba0f03fbe4acff730539ff8fd03a1f7
-
SSDEEP
49152:Kc9/eQEkgtzvJsNgJNSH5IWFtnmxiGQKuWXQOhcguRpSontOn7P:v9yagJNyFwx9uO2zSo87
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\SysWOW64\\rundll32.exe" rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2568 2444 rundll32.exe 28 PID 2444 wrote to memory of 2568 2444 rundll32.exe 28 PID 2444 wrote to memory of 2568 2444 rundll32.exe 28 PID 2444 wrote to memory of 2568 2444 rundll32.exe 28 PID 2444 wrote to memory of 2568 2444 rundll32.exe 28 PID 2444 wrote to memory of 2568 2444 rundll32.exe 28 PID 2444 wrote to memory of 2568 2444 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac3952245d3d68f496b192c9b2c5a3e7e9e22136df0fcca91e1237dfa665a975.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac3952245d3d68f496b192c9b2c5a3e7e9e22136df0fcca91e1237dfa665a975.dll,#12⤵
- Adds Run key to start application
PID:2568
-