Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
22/09/2023, 05:14 UTC
Behavioral task
behavioral1
Sample
b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll
Resource
win10v2004-20230915-en
General
-
Target
b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll
-
Size
50KB
-
MD5
25d3fe49679f55972b58a98044e9d2c9
-
SHA1
3730b913d733706975df85df9ce65007b6ba1142
-
SHA256
b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff
-
SHA512
81034f46a99013c4c54c82d31d84357c4430e7dd039673be62397f47e92cd3b3d1ea428bf2873353f281253b480dd5806d4aa0c23c0c0d1bcc78fd27b3234ba0
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5zJYH:W5ReWjTrW9rNPgYoRJYH
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1992 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1992 2024 rundll32.exe 28 PID 2024 wrote to memory of 1992 2024 rundll32.exe 28 PID 2024 wrote to memory of 1992 2024 rundll32.exe 28 PID 2024 wrote to memory of 1992 2024 rundll32.exe 28 PID 2024 wrote to memory of 1992 2024 rundll32.exe 28 PID 2024 wrote to memory of 1992 2024 rundll32.exe 28 PID 2024 wrote to memory of 1992 2024 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1992
-