Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
033810b36c9f01677a5e450044ee9325.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
033810b36c9f01677a5e450044ee9325.dll
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
033810b36c9f01677a5e450044ee9325.dll
-
Size
406KB
-
MD5
033810b36c9f01677a5e450044ee9325
-
SHA1
afc88f4cead9e5a10a472a2491b9d92ad6b2205f
-
SHA256
bdc5a1cf991cf18ad72ddd7ce05ad26b9bc5563e8ee80ec3ba9e644db6fe53bf
-
SHA512
3817b376b9df63604aa754ccff3739fc87d94b5ceb469f9df407ed1f08bae33d1719b68b81b1c2cfd4a1db4318f88a0cfdb858f6145f22996c9f85615f5aaf84
-
SSDEEP
12288:zWewL/wxCQcO4Q9etbdaeGWZYKqqKysqMBi29:zW8w24QybdSUJqq2Bz9
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2132 rundll32.exe 2132 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2132 2160 rundll32.exe 28 PID 2160 wrote to memory of 2132 2160 rundll32.exe 28 PID 2160 wrote to memory of 2132 2160 rundll32.exe 28 PID 2160 wrote to memory of 2132 2160 rundll32.exe 28 PID 2160 wrote to memory of 2132 2160 rundll32.exe 28 PID 2160 wrote to memory of 2132 2160 rundll32.exe 28 PID 2160 wrote to memory of 2132 2160 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\033810b36c9f01677a5e450044ee9325.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\033810b36c9f01677a5e450044ee9325.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132
-