Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3binaries/E...64.dll
windows7-x64
1binaries/E...64.dll
windows10-2004-x64
1binaries/L...64.dll
windows7-x64
1binaries/L...64.dll
windows10-2004-x64
1binaries/S...ar.exe
windows7-x64
1binaries/S...ar.exe
windows10-2004-x64
1binaries/s...64.dll
windows7-x64
1binaries/s...64.dll
windows10-2004-x64
1binaries/s...me.dll
windows7-x64
1binaries/s...me.dll
windows10-2004-x64
1binaries/s...er.dll
windows7-x64
1binaries/s...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/01/2024, 17:30
Static task
static1
Behavioral task
behavioral1
Sample
binaries/Emulator64.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
binaries/Emulator64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
binaries/LinkNeverDie_Com_64.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
binaries/LinkNeverDie_Com_64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
binaries/Switcher Spacewar.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
binaries/Switcher Spacewar.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
binaries/steam_api64.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
binaries/steam_api64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
binaries/steam_api64_org_game.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
binaries/steam_api64_org_game.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
binaries/steam_api64_org_launcher.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
binaries/steam_api64_org_launcher.dll
Resource
win10v2004-20231222-en
General
-
Target
binaries/steam_api64.dll
-
Size
135KB
-
MD5
8b94f89dbc5dfa9f4e59b860cded9f5d
-
SHA1
d3f392c5f20ce1bcbf13c3c6f770ca62c3501afd
-
SHA256
e545574b59309bd11b519aef94b08ee62ba794037e28ef8c2a95021307e24154
-
SHA512
0da19b72633fff3a3d069d6f1d70f65243ae401c3de5414a95d8de60659d777366da623cba14dea1d72dddf3ff6b0d5cda798c3c47a88e8d8912224fd692770f
-
SSDEEP
3072:f8TaJf5llFFPyN++ebUIIC0lBnZBWvrN1kfVF:f8eFNnyBC07nLfV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2856 2616 rundll32.exe 28 PID 2616 wrote to memory of 2856 2616 rundll32.exe 28 PID 2616 wrote to memory of 2856 2616 rundll32.exe 28