Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
13/11/2023, 14:48
Behavioral task
behavioral1
Sample
53d79e6cbb61ddb2de128e807febe7e4ac02610573a8416fb58a3f878775c6d6.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
53d79e6cbb61ddb2de128e807febe7e4ac02610573a8416fb58a3f878775c6d6.dll
Resource
win10v2004-20231020-en
General
-
Target
53d79e6cbb61ddb2de128e807febe7e4ac02610573a8416fb58a3f878775c6d6.dll
-
Size
899KB
-
MD5
70f910cd4d939082faf2e14f5b375b63
-
SHA1
213d56371668a022f55877399a2cb7e2c755269e
-
SHA256
53d79e6cbb61ddb2de128e807febe7e4ac02610573a8416fb58a3f878775c6d6
-
SHA512
afa83f02389e3860aa553c23118948b3015bb4f24747fa06bf9b578118dcc0e887ba6cf0fc3ef9a871af434235c66659d29b0b19ea511fa20cb68e22adacbdbf
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXq:7wqd87Vq
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1696 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 892 wrote to memory of 1696 892 rundll32.exe 28 PID 892 wrote to memory of 1696 892 rundll32.exe 28 PID 892 wrote to memory of 1696 892 rundll32.exe 28 PID 892 wrote to memory of 1696 892 rundll32.exe 28 PID 892 wrote to memory of 1696 892 rundll32.exe 28 PID 892 wrote to memory of 1696 892 rundll32.exe 28 PID 892 wrote to memory of 1696 892 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53d79e6cbb61ddb2de128e807febe7e4ac02610573a8416fb58a3f878775c6d6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53d79e6cbb61ddb2de128e807febe7e4ac02610573a8416fb58a3f878775c6d6.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1696
-