Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 23:21
Behavioral task
behavioral1
Sample
13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll
Resource
win7-20230831-en
4 signatures
150 seconds
General
-
Target
13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll
-
Size
9.2MB
-
MD5
53451ddc38f39bfcb68f513cea02d5cc
-
SHA1
73c3a73b8bad6a4445ecf8a43041bf155c1fa0b2
-
SHA256
13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335
-
SHA512
5afbc1e45979cd10f48d111956a60187b0389d5ce35ebf855b31116cef21515c8f08a3835af9e5124d2422686501d054a18d3ef174915ab85948cc4fdb7a2bb5
-
SSDEEP
196608:u3qVFB7PnpPvypQqOh/+7WWXtpI/rak3gaKKljMwDnTmN:u3mPnpPapROiI2k3hkk
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2160-0-0x0000000010000000-0x000000001093B000-memory.dmp family_blackmoon -
resource yara_rule behavioral1/memory/2160-0-0x0000000010000000-0x000000001093B000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2160 2152 rundll32.exe 28 PID 2152 wrote to memory of 2160 2152 rundll32.exe 28 PID 2152 wrote to memory of 2160 2152 rundll32.exe 28 PID 2152 wrote to memory of 2160 2152 rundll32.exe 28 PID 2152 wrote to memory of 2160 2152 rundll32.exe 28 PID 2152 wrote to memory of 2160 2152 rundll32.exe 28 PID 2152 wrote to memory of 2160 2152 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll,#12⤵PID:2160
-