Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
f4e1fd5cf0027d5eeb4c55cb7f73782a0954a609ab47266fe5c173e70f53dc15.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f4e1fd5cf0027d5eeb4c55cb7f73782a0954a609ab47266fe5c173e70f53dc15.dll
Resource
win10v2004-20231215-en
General
-
Target
f4e1fd5cf0027d5eeb4c55cb7f73782a0954a609ab47266fe5c173e70f53dc15.dll
-
Size
397KB
-
MD5
0e3376ce1a7aab329485114255bca590
-
SHA1
92b119f5284d9b11c4ee3aa0a8de53162347ce41
-
SHA256
f4e1fd5cf0027d5eeb4c55cb7f73782a0954a609ab47266fe5c173e70f53dc15
-
SHA512
15b8960b63045e437efe2905a5340bf11cd50bd01a7d138e5dbb17c0b895b06efb0f547a00b73ad743ae94dd05a5a0334ee40235a883697015a42657a8a7cdf5
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa/:174g2LDeiPDImOkx2LIa/
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2372 rundll32.exe Token: SeTcbPrivilege 2372 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2372 2040 rundll32.exe 28 PID 2040 wrote to memory of 2372 2040 rundll32.exe 28 PID 2040 wrote to memory of 2372 2040 rundll32.exe 28 PID 2040 wrote to memory of 2372 2040 rundll32.exe 28 PID 2040 wrote to memory of 2372 2040 rundll32.exe 28 PID 2040 wrote to memory of 2372 2040 rundll32.exe 28 PID 2040 wrote to memory of 2372 2040 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e1fd5cf0027d5eeb4c55cb7f73782a0954a609ab47266fe5c173e70f53dc15.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e1fd5cf0027d5eeb4c55cb7f73782a0954a609ab47266fe5c173e70f53dc15.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-