Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 14:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0115ca9901e35dd33226f76587175f9a.dll
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0115ca9901e35dd33226f76587175f9a.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
0115ca9901e35dd33226f76587175f9a.dll
-
Size
173KB
-
MD5
0115ca9901e35dd33226f76587175f9a
-
SHA1
674da62b274681e8d71a7b70994d8fef993643a4
-
SHA256
dd4ba8abe88f4a2a3f9eccc64f0e22fc77b341c750604618cccd93c8c9cbba28
-
SHA512
69ec23e843f43ceb13e8210a4cf0121791ccebce466d79b68b432f41bc7d54c0e518ca3584cc149151d2cbc1b710b454a6b2642cbb0d0f58b76628736a82407e
-
SSDEEP
3072:7OT05oZPGSw632OjXIqR/GgMoaHFTw0CSkTTqQ4jU7JM3D743N1:iTeRSzVDNkk0vkfqQet6N1
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ernel32.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\ernel32.dll rundll32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2652 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2652 2748 rundll32.exe 16 PID 2748 wrote to memory of 2652 2748 rundll32.exe 16 PID 2748 wrote to memory of 2652 2748 rundll32.exe 16 PID 2748 wrote to memory of 2652 2748 rundll32.exe 16 PID 2748 wrote to memory of 2652 2748 rundll32.exe 16 PID 2748 wrote to memory of 2652 2748 rundll32.exe 16 PID 2748 wrote to memory of 2652 2748 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0115ca9901e35dd33226f76587175f9a.dll,#11⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2652
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0115ca9901e35dd33226f76587175f9a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2748