Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 18:56

General

  • Target

    e8cf0a83a0d37983526ec487e686b18d2851e24a306be7f7650d5c5543c45142.dll

  • Size

    76KB

  • MD5

    7000d725b5cb1dc138c1ec03672107a9

  • SHA1

    90919a789eb4e2ac4cec6037eac25cb8883189d0

  • SHA256

    e8cf0a83a0d37983526ec487e686b18d2851e24a306be7f7650d5c5543c45142

  • SHA512

    00d6f80b911a226ad8eb1a34debd303c582d8473cd992f4965bc3382fde93db38e7ca3110ff2115ab26c725380d9619ecf4c410975e3ff6205403052936f3aa1

  • SSDEEP

    1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZJxL4KUH:c8y93KQjy7G55riF1cMo03bxLxUH

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8cf0a83a0d37983526ec487e686b18d2851e24a306be7f7650d5c5543c45142.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8cf0a83a0d37983526ec487e686b18d2851e24a306be7f7650d5c5543c45142.dll,#1
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1432-6-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/1432-0-0x0000000000070000-0x0000000000071000-memory.dmp

    Filesize

    4KB

  • memory/1432-8-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/1432-9-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB