Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
16fed3888935c0e924e91246a38aad78d1170fa694384106de9a7146fc8cdc54.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
16fed3888935c0e924e91246a38aad78d1170fa694384106de9a7146fc8cdc54.dll
Resource
win10v2004-20231222-en
General
-
Target
16fed3888935c0e924e91246a38aad78d1170fa694384106de9a7146fc8cdc54.dll
-
Size
397KB
-
MD5
0de669dab677cab3296b2a11ebf23905
-
SHA1
a8c09e84cedd040f947ed0b5a833145cc7500eb2
-
SHA256
16fed3888935c0e924e91246a38aad78d1170fa694384106de9a7146fc8cdc54
-
SHA512
5f82380fc1c457cc975b59fc3ace1a39bdec86a907f01eef0c7628fa0a27dc5eb31e30037421ed7352892bca7a6c1423a818ffc8cae6d2c71490958d165db371
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOah:174g2LDeiPDImOkx2LIah
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2140 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2140 rundll32.exe Token: SeTcbPrivilege 2140 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2140 2640 rundll32.exe 28 PID 2640 wrote to memory of 2140 2640 rundll32.exe 28 PID 2640 wrote to memory of 2140 2640 rundll32.exe 28 PID 2640 wrote to memory of 2140 2640 rundll32.exe 28 PID 2640 wrote to memory of 2140 2640 rundll32.exe 28 PID 2640 wrote to memory of 2140 2640 rundll32.exe 28 PID 2640 wrote to memory of 2140 2640 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16fed3888935c0e924e91246a38aad78d1170fa694384106de9a7146fc8cdc54.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16fed3888935c0e924e91246a38aad78d1170fa694384106de9a7146fc8cdc54.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140
-