Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 07:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d30016928b01dd8174dd4d761e8c59a.dll
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d30016928b01dd8174dd4d761e8c59a.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
2d30016928b01dd8174dd4d761e8c59a.dll
-
Size
20KB
-
MD5
2d30016928b01dd8174dd4d761e8c59a
-
SHA1
b8b69766d1431f552fe5e683937e54c0b46fdade
-
SHA256
aafa72cd045973ca7abfd00f303c7f638afda66baea429c8c9294e8351b95b7b
-
SHA512
e749c256f2cd73599c6dc4d8c9dd552a5e17c66de15c5d6e040ff1540eb109e7403981013ef495e36b6ad6646496500028290ad1d12ba93d285b2d316d170e34
-
SSDEEP
384:8uhaDJGBCpJPmYlF/QxzjADKCINl0FLJC1qIqFuym:ylGUpJP9QNAdZjC14FP
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1132 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3060 wrote to memory of 1132 3060 rundll32.exe 16 PID 3060 wrote to memory of 1132 3060 rundll32.exe 16 PID 3060 wrote to memory of 1132 3060 rundll32.exe 16 PID 3060 wrote to memory of 1132 3060 rundll32.exe 16 PID 3060 wrote to memory of 1132 3060 rundll32.exe 16 PID 3060 wrote to memory of 1132 3060 rundll32.exe 16 PID 3060 wrote to memory of 1132 3060 rundll32.exe 16
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d30016928b01dd8174dd4d761e8c59a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d30016928b01dd8174dd4d761e8c59a.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1132
-