Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
23/10/2023, 07:36
Behavioral task
behavioral1
Sample
73c55b27854c45bced44a6826d12f7518eeef81fe993590717ef0d0ec6d0865d.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
73c55b27854c45bced44a6826d12f7518eeef81fe993590717ef0d0ec6d0865d.dll
Resource
win10v2004-20231020-en
General
-
Target
73c55b27854c45bced44a6826d12f7518eeef81fe993590717ef0d0ec6d0865d.dll
-
Size
899KB
-
MD5
27a4693241b6888845440afd11a381ca
-
SHA1
c348f3d499753b14f31e407ef1c0d80b51bd4669
-
SHA256
73c55b27854c45bced44a6826d12f7518eeef81fe993590717ef0d0ec6d0865d
-
SHA512
6da6b01470eaff5e8f5651f81ebb212f98afb492223dd051b010c3b1573afcef3055b8836902a839358fc03b9647634209f2290dae6cf8633e4b65eac7e16b4d
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXT:7wqd87VT
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2128 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2128 3036 rundll32.exe 28 PID 3036 wrote to memory of 2128 3036 rundll32.exe 28 PID 3036 wrote to memory of 2128 3036 rundll32.exe 28 PID 3036 wrote to memory of 2128 3036 rundll32.exe 28 PID 3036 wrote to memory of 2128 3036 rundll32.exe 28 PID 3036 wrote to memory of 2128 3036 rundll32.exe 28 PID 3036 wrote to memory of 2128 3036 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73c55b27854c45bced44a6826d12f7518eeef81fe993590717ef0d0ec6d0865d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73c55b27854c45bced44a6826d12f7518eeef81fe993590717ef0d0ec6d0865d.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2128
-