Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/08/2023, 02:04
Behavioral task
behavioral1
Sample
bb8f399d249bf2c18b5602be333f77b0a47456dcdfdb29c0106db29d3065f0a0.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bb8f399d249bf2c18b5602be333f77b0a47456dcdfdb29c0106db29d3065f0a0.dll
Resource
win10v2004-20230703-en
General
-
Target
bb8f399d249bf2c18b5602be333f77b0a47456dcdfdb29c0106db29d3065f0a0.dll
-
Size
50KB
-
MD5
ab8530279159cd967622505cec6425eb
-
SHA1
f6b60d578eb4da7962de7649c56226a991a55d76
-
SHA256
bb8f399d249bf2c18b5602be333f77b0a47456dcdfdb29c0106db29d3065f0a0
-
SHA512
6677d842c6b169655b53d0add2543ac8977cf130e575c4e85879265eec9f223d63ebfb9da4ff39b885b2649c39988855c6bc4dbd1da6817023e8d242635cd11f
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5UJYH:W5ReWjTrW9rNPgYoiJYH
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2796 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2796 1924 rundll32.exe 28 PID 1924 wrote to memory of 2796 1924 rundll32.exe 28 PID 1924 wrote to memory of 2796 1924 rundll32.exe 28 PID 1924 wrote to memory of 2796 1924 rundll32.exe 28 PID 1924 wrote to memory of 2796 1924 rundll32.exe 28 PID 1924 wrote to memory of 2796 1924 rundll32.exe 28 PID 1924 wrote to memory of 2796 1924 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bb8f399d249bf2c18b5602be333f77b0a47456dcdfdb29c0106db29d3065f0a0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bb8f399d249bf2c18b5602be333f77b0a47456dcdfdb29c0106db29d3065f0a0.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2796
-