Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 19:57
Behavioral task
behavioral1
Sample
4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll
Resource
win10v2004-20240226-en
General
-
Target
4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll
-
Size
50KB
-
MD5
2b86a0794c314b189b9780e1c5fd73c8
-
SHA1
2dfba73b97be5c14a8319dda9096b42042565caa
-
SHA256
4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f
-
SHA512
baf1bd9c8298f56df9df030a2a5c8dbb70acafce1b4355e5c7741db04da2590eeb82f085fd9428081c42300a5e86fa8b4e8bc6f24446c932a5b517c07833da9a
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5aJYH:W5ReWjTrW9rNPgYo4JYH
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1636 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2768 wrote to memory of 1636 2768 rundll32.exe 28 PID 2768 wrote to memory of 1636 2768 rundll32.exe 28 PID 2768 wrote to memory of 1636 2768 rundll32.exe 28 PID 2768 wrote to memory of 1636 2768 rundll32.exe 28 PID 2768 wrote to memory of 1636 2768 rundll32.exe 28 PID 2768 wrote to memory of 1636 2768 rundll32.exe 28 PID 2768 wrote to memory of 1636 2768 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1636
-