Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18/09/2023, 15:28
Behavioral task
behavioral1
Sample
06fb2be58cd13b1722a77b663bbe423b5448f095f28aa8d90ffff389d71cace8.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
06fb2be58cd13b1722a77b663bbe423b5448f095f28aa8d90ffff389d71cace8.dll
Resource
win10v2004-20230915-en
General
-
Target
06fb2be58cd13b1722a77b663bbe423b5448f095f28aa8d90ffff389d71cace8.dll
-
Size
899KB
-
MD5
829f1e94d0a5ac3610f9d4abecdf5f29
-
SHA1
af815fc845f566a9548c101573d1cea87426c376
-
SHA256
06fb2be58cd13b1722a77b663bbe423b5448f095f28aa8d90ffff389d71cace8
-
SHA512
eeabe45de8d77d5b9ec2cb1f30aa8dfd8a713680b8d3d2030343289a0b433a32050601868a8365de11349a178da9c65a9b46a2c50ab4b9d0dff4aea7b8504d3f
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXX:7wqd87VX
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2308 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2308 1672 rundll32.exe 28 PID 1672 wrote to memory of 2308 1672 rundll32.exe 28 PID 1672 wrote to memory of 2308 1672 rundll32.exe 28 PID 1672 wrote to memory of 2308 1672 rundll32.exe 28 PID 1672 wrote to memory of 2308 1672 rundll32.exe 28 PID 1672 wrote to memory of 2308 1672 rundll32.exe 28 PID 1672 wrote to memory of 2308 1672 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06fb2be58cd13b1722a77b663bbe423b5448f095f28aa8d90ffff389d71cace8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06fb2be58cd13b1722a77b663bbe423b5448f095f28aa8d90ffff389d71cace8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2308
-