Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll
Resource
win10v2004-20231215-en
General
-
Target
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll
-
Size
397KB
-
MD5
86fe6557f8f2d3758dbb29816eb18a8c
-
SHA1
84612a2dbc60073680a51af7bf4f2a8145980956
-
SHA256
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6
-
SHA512
a92358a32bcb941373fe83d487ddb4993d4cd249ae793b1a8928fcfbf7220c777082bacde1cccc12b5845a0668f4341e046ffb4892fd2363754fbbf54947256e
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaH:174g2LDeiPDImOkx2LIaH
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2520 rundll32.exe 2520 rundll32.exe 2520 rundll32.exe 2520 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2520 rundll32.exe Token: SeTcbPrivilege 2520 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2520 3068 rundll32.exe 28 PID 3068 wrote to memory of 2520 3068 rundll32.exe 28 PID 3068 wrote to memory of 2520 3068 rundll32.exe 28 PID 3068 wrote to memory of 2520 3068 rundll32.exe 28 PID 3068 wrote to memory of 2520 3068 rundll32.exe 28 PID 3068 wrote to memory of 2520 3068 rundll32.exe 28 PID 3068 wrote to memory of 2520 3068 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-