Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 00:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8dc7f3508928cc28fc2cd9859f917149.dll
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8dc7f3508928cc28fc2cd9859f917149.dll
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
8dc7f3508928cc28fc2cd9859f917149.dll
-
Size
232KB
-
MD5
8dc7f3508928cc28fc2cd9859f917149
-
SHA1
df554ae16429315bf017eaa22f2ba53592d546e3
-
SHA256
3f434ed77d8d4a73003259af8bd894252f4b2985da7e9222c09ab0c8ae646d05
-
SHA512
81a368feaee1bdf2b9a11fe15dfabef8f286ccf329fbc7d6529451d1556092f71ecdf242367548d743e8b68391f0ffbf9fd005b76c945a31d7ec376dca67b290
-
SSDEEP
6144:SRoZzA7ZeRRoALxhasKO39vCGwRoEGDyl:SRhsRuALxtWq
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Hhorowo = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\8dc7f3508928cc28fc2cd9859f917149.dll\",Startup" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2672 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1232 wrote to memory of 2672 1232 rundll32.exe 28 PID 1232 wrote to memory of 2672 1232 rundll32.exe 28 PID 1232 wrote to memory of 2672 1232 rundll32.exe 28 PID 1232 wrote to memory of 2672 1232 rundll32.exe 28 PID 1232 wrote to memory of 2672 1232 rundll32.exe 28 PID 1232 wrote to memory of 2672 1232 rundll32.exe 28 PID 1232 wrote to memory of 2672 1232 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8dc7f3508928cc28fc2cd9859f917149.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8dc7f3508928cc28fc2cd9859f917149.dll,#12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2672
-