Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 03:00
Static task
static1
Behavioral task
behavioral1
Sample
636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll
Resource
win10v2004-20240226-en
General
-
Target
636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll
-
Size
980KB
-
MD5
012aefdfa90542259103e5108ff4bba9
-
SHA1
6f2652f1a6a94d7eee20e0bb037cbd51779dafe7
-
SHA256
636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65
-
SHA512
ab110473410a30dbeb676f79e5653094cbf8f2d6f44414fa5020953c907e31edd7d95b2453f2b4a062023d8ef137cc639ede2bcfe7f84794d83ef975cdbb6b8c
-
SSDEEP
24576:nZQcaNvHu27o1i4v6sjaUwdr4M5gx6uxVNMtRqM60dXzDg:nycQvOg/XA
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 2 1752 rundll32.exe 5 1752 rundll32.exe 6 1752 rundll32.exe 7 1752 rundll32.exe 8 1752 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1752 2208 rundll32.exe 28 PID 2208 wrote to memory of 1752 2208 rundll32.exe 28 PID 2208 wrote to memory of 1752 2208 rundll32.exe 28 PID 2208 wrote to memory of 1752 2208 rundll32.exe 28 PID 2208 wrote to memory of 1752 2208 rundll32.exe 28 PID 2208 wrote to memory of 1752 2208 rundll32.exe 28 PID 2208 wrote to memory of 1752 2208 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll,#12⤵
- Blocklisted process makes network request
PID:1752
-