Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 23:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e3cd19475011c0b015c813704417f18.dll
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e3cd19475011c0b015c813704417f18.dll
Resource
win10v2004-20231222-en
5 signatures
150 seconds
General
-
Target
7e3cd19475011c0b015c813704417f18.dll
-
Size
11KB
-
MD5
7e3cd19475011c0b015c813704417f18
-
SHA1
f5642198ebb311671d7ce45ae63adda1a570f0a8
-
SHA256
2fdda006c11b2ace6061dff4c18ebf78439330f58dde762a1b9a980522cfc13d
-
SHA512
d0799c8c74e4fb5c61b56a766d1de29961730a0933139a804faf828f1ecc948f540f2e21b6bb0389aa2a9a1e014d2355ac9b8d6d96c2ae25ba7b103855ab58c2
-
SSDEEP
192:0cUmR7G50XmqV6vcqnyox0KrKYOewhne/PJlyma+EY3573fkgUw9HV:g4eLk6vcqy4jONe3Sma+UeV
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 480 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1716 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1716 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1716 1776 rundll32.exe 28 PID 1776 wrote to memory of 1716 1776 rundll32.exe 28 PID 1776 wrote to memory of 1716 1776 rundll32.exe 28 PID 1776 wrote to memory of 1716 1776 rundll32.exe 28 PID 1776 wrote to memory of 1716 1776 rundll32.exe 28 PID 1776 wrote to memory of 1716 1776 rundll32.exe 28 PID 1776 wrote to memory of 1716 1776 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7e3cd19475011c0b015c813704417f18.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7e3cd19475011c0b015c813704417f18.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1716
-