Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
8b73e4f0319f5fdb14c4d02d62bc2ba0.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b73e4f0319f5fdb14c4d02d62bc2ba0.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
8b73e4f0319f5fdb14c4d02d62bc2ba0.dll
-
Size
31KB
-
MD5
8b73e4f0319f5fdb14c4d02d62bc2ba0
-
SHA1
867508bbf6eed07bb7c07eaa962e25ed732f8326
-
SHA256
11d212aef480820ba5423aa6d2932fc364d630e960f203e236fe860271186f23
-
SHA512
913312d398d613efd1ef48886d4e0c375bd41a05931ce0449331aa7841078711dfe96f7eb36804624b6427c0d92337b1d940942ded01d93280eb4d3f8f0b5b9f
-
SSDEEP
768:oyfKGXNgSN0i1zJn25w6gtMgNtBKC7kLs:Xig0i1x28NtBd7Ys
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2656 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2656 2552 rundll32.exe 28 PID 2552 wrote to memory of 2656 2552 rundll32.exe 28 PID 2552 wrote to memory of 2656 2552 rundll32.exe 28 PID 2552 wrote to memory of 2656 2552 rundll32.exe 28 PID 2552 wrote to memory of 2656 2552 rundll32.exe 28 PID 2552 wrote to memory of 2656 2552 rundll32.exe 28 PID 2552 wrote to memory of 2656 2552 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b73e4f0319f5fdb14c4d02d62bc2ba0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b73e4f0319f5fdb14c4d02d62bc2ba0.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2656
-