Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 23:32
Behavioral task
behavioral1
Sample
7d5c1f95c7005d85b60f166cb6dec1895b648e597e1ca672b693163fee26cf84.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
7d5c1f95c7005d85b60f166cb6dec1895b648e597e1ca672b693163fee26cf84.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
7d5c1f95c7005d85b60f166cb6dec1895b648e597e1ca672b693163fee26cf84.dll
-
Size
1.3MB
-
MD5
00d895d1447afe0cc287964bc2cca439
-
SHA1
57187f30f6981921c686843ecdcf3756c7f2272d
-
SHA256
7d5c1f95c7005d85b60f166cb6dec1895b648e597e1ca672b693163fee26cf84
-
SHA512
5b0fed1a4628eb6b877c07cd334a7fb4befb3da66c7b9100aa5d95d809d22e3ec69a2a3f4cfd0dc08ebe70ac740de1aeaacef60fc5e4351e745db7c4214a4178
-
SSDEEP
24576:gUK/+p8q03+U3irw2zABeob/EhoXdnRlreuvCQTJptkgtKlD980YDdQ:g/QYiEBtAMn3FvCsL7tY+C
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 3 1920 rundll32.exe 5 1920 rundll32.exe 7 1920 rundll32.exe 8 1920 rundll32.exe 9 1920 rundll32.exe 10 1920 rundll32.exe 11 1920 rundll32.exe 12 1920 rundll32.exe 13 1920 rundll32.exe 14 1920 rundll32.exe 15 1920 rundll32.exe 16 1920 rundll32.exe 17 1920 rundll32.exe 18 1920 rundll32.exe 19 1920 rundll32.exe 20 1920 rundll32.exe 21 1920 rundll32.exe 22 1920 rundll32.exe 23 1920 rundll32.exe 24 1920 rundll32.exe 25 1920 rundll32.exe 26 1920 rundll32.exe 27 1920 rundll32.exe 28 1920 rundll32.exe 29 1920 rundll32.exe 30 1920 rundll32.exe 31 1920 rundll32.exe 32 1920 rundll32.exe 33 1920 rundll32.exe 34 1920 rundll32.exe 35 1920 rundll32.exe 36 1920 rundll32.exe 37 1920 rundll32.exe 38 1920 rundll32.exe 39 1920 rundll32.exe 40 1920 rundll32.exe 41 1920 rundll32.exe 42 1920 rundll32.exe 43 1920 rundll32.exe 44 1920 rundll32.exe 45 1920 rundll32.exe 46 1920 rundll32.exe 47 1920 rundll32.exe 48 1920 rundll32.exe 49 1920 rundll32.exe 50 1920 rundll32.exe 51 1920 rundll32.exe 52 1920 rundll32.exe 53 1920 rundll32.exe 54 1920 rundll32.exe 55 1920 rundll32.exe 56 1920 rundll32.exe 57 1920 rundll32.exe 58 1920 rundll32.exe 59 1920 rundll32.exe 60 1920 rundll32.exe 61 1920 rundll32.exe 62 1920 rundll32.exe 63 1920 rundll32.exe 64 1920 rundll32.exe 65 1920 rundll32.exe 66 1920 rundll32.exe 67 1920 rundll32.exe 68 1920 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1920 1952 rundll32.exe 28 PID 1952 wrote to memory of 1920 1952 rundll32.exe 28 PID 1952 wrote to memory of 1920 1952 rundll32.exe 28 PID 1952 wrote to memory of 1920 1952 rundll32.exe 28 PID 1952 wrote to memory of 1920 1952 rundll32.exe 28 PID 1952 wrote to memory of 1920 1952 rundll32.exe 28 PID 1952 wrote to memory of 1920 1952 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d5c1f95c7005d85b60f166cb6dec1895b648e597e1ca672b693163fee26cf84.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d5c1f95c7005d85b60f166cb6dec1895b648e597e1ca672b693163fee26cf84.dll,#12⤵
- Blocklisted process makes network request
PID:1920
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64WRFCMO\YNBR08NM.htm
Filesize378KB
MD52c51bd8e2167278e42c6d77efd364f6b
SHA165c5970f6b4cb9555c179450c664b121172c3ddd
SHA256a223d86759b7052a4f378e5f2522442a0041f4470eaddf692ed9f21fd57fe3d5
SHA51200ac03faa02461a49cec35db61e717e8f5e9f111492dc842b52f9fea3f8892eb3231b735c5962bdc4078d398af6e1bf68c676d780d431db5398d4f3981c00026