Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04a0220134a86e5086fc18cce31dbd33.dll
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
04a0220134a86e5086fc18cce31dbd33.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
04a0220134a86e5086fc18cce31dbd33.dll
-
Size
162KB
-
MD5
04a0220134a86e5086fc18cce31dbd33
-
SHA1
0aa29a4a793610ecbbbb10db9ac896cab65f5e4a
-
SHA256
627c9903bc9d0dacc325b03c7580a3cad22f8d95308e2e1dfdaf2db9426ff0bb
-
SHA512
0f725164d023880a4eaa601a6043f87f119d66b2b257efcf7e021d665e2115dc5538a5edb58e5c25d7ed9d274a5fd1d2a2ee5bbd7272b8dfa218193fc2fb8db2
-
SSDEEP
3072:3EZB94/pzXckR9TsCz8fjfkjJmh02zW7GDkHxIswAA:3GABzMg9ngQ1mh07ywItAA
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 4 2684 rundll32.exe 10 2684 rundll32.exe 14 2684 rundll32.exe 17 2684 rundll32.exe 21 2684 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2684 rundll32.exe Token: SeDebugPrivilege 2684 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2684 2840 rundll32.exe 17 PID 2840 wrote to memory of 2684 2840 rundll32.exe 17 PID 2840 wrote to memory of 2684 2840 rundll32.exe 17 PID 2840 wrote to memory of 2684 2840 rundll32.exe 17 PID 2840 wrote to memory of 2684 2840 rundll32.exe 17 PID 2840 wrote to memory of 2684 2840 rundll32.exe 17 PID 2840 wrote to memory of 2684 2840 rundll32.exe 17
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04a0220134a86e5086fc18cce31dbd33.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04a0220134a86e5086fc18cce31dbd33.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:2684
-