Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:28
Behavioral task
behavioral1
Sample
0cf7b0e2ce5b5ca401d31016f92a7fc2.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0cf7b0e2ce5b5ca401d31016f92a7fc2.dll
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
0cf7b0e2ce5b5ca401d31016f92a7fc2.dll
-
Size
15KB
-
MD5
0cf7b0e2ce5b5ca401d31016f92a7fc2
-
SHA1
6a5c6042b4e6da09829d3a774f2e04913dab5d63
-
SHA256
945c94ac15326e0f2d8981211a0395821208872da46a59e502c0a3537dd17f77
-
SHA512
204b37163d7868d72ff6a356843d457052ac206a726fcc35f56ef07de4d7e23fe794060f5f1cd17a048bdb594a9b6233f8cbd72b7a9d1335fdd83aec09a77555
-
SSDEEP
192:8jeLE+15WnobmblAhnwSpUALcSaUzVP42fyWjBjip7xgYbkk6e0o9J1kgj7HqEEc:8UEWWVJAxBxhjipxjJ9KEECS0
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2336-0-0x0000000010000000-0x000000001000E000-memory.dmp upx behavioral1/memory/2336-2-0x0000000010000000-0x000000001000E000-memory.dmp upx behavioral1/memory/2336-3-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2336 2052 rundll32.exe 28 PID 2052 wrote to memory of 2336 2052 rundll32.exe 28 PID 2052 wrote to memory of 2336 2052 rundll32.exe 28 PID 2052 wrote to memory of 2336 2052 rundll32.exe 28 PID 2052 wrote to memory of 2336 2052 rundll32.exe 28 PID 2052 wrote to memory of 2336 2052 rundll32.exe 28 PID 2052 wrote to memory of 2336 2052 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf7b0e2ce5b5ca401d31016f92a7fc2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf7b0e2ce5b5ca401d31016f92a7fc2.dll,#12⤵PID:2336
-