Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
RMCScript.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RMCScript.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
RMScript.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
RMScript.exe
Resource
win10v2004-20240226-en
General
-
Target
RMCScript.dll
-
Size
793KB
-
MD5
5916dab076d92731576799beb728ca14
-
SHA1
486dac1c015f8f972445d7862d85bc0615a283e9
-
SHA256
bf7f3d9c71336d89fd7cefb8111daeb1cbcdfd8658b61c70a57809c2857c3728
-
SHA512
732e2748e985a9bbd21b1fa419b66e64cf6db2cc7c6a70cb26d33256a14ed98884fa0aeb49860759b5241b11c327f6cc8cb38fa4da33a70772c572b7641d839c
-
SSDEEP
24576:DiECy56KD+AtdOZbdH/IZQn8GhjHKyjyMcOKMNr0yAj:DivkD+At0V/qGhLKEbcBMNr
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2100 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2100 1964 rundll32.exe 28 PID 1964 wrote to memory of 2100 1964 rundll32.exe 28 PID 1964 wrote to memory of 2100 1964 rundll32.exe 28 PID 1964 wrote to memory of 2100 1964 rundll32.exe 28 PID 1964 wrote to memory of 2100 1964 rundll32.exe 28 PID 1964 wrote to memory of 2100 1964 rundll32.exe 28 PID 1964 wrote to memory of 2100 1964 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\RMCScript.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\RMCScript.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2100
-