Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 20:58
Behavioral task
behavioral1
Sample
dos.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dos.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
libeay32.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
libeay32.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
ssleay32.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ssleay32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ucmyqb.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
ucmyqb.dll
Resource
win10v2004-20240704-en
General
-
Target
libeay32.dll
-
Size
482KB
-
MD5
c2703965b8ba0ecf8c5d8a043976facc
-
SHA1
c578c694d4fe5c15acc3b7aa60e9874d0ded3d54
-
SHA256
e28e34fbdaff077669586dcdb4e10f0ba2ca6c9973ed4d372a5c3ec3b8ad20e7
-
SHA512
cb729665206594928a90b29e5c7592120345e92a605122ec6aea564250c4d5d48e1d39c8803820eccde7920aa4d9af99fb3748671de076476d833710b9491d61
-
SSDEEP
6144:GyAl+J4uce42ylALXYsGB9ZaPEZ3ahnZHFiZlfK/d77ycLFG4683UyS7zooSQQ1z:1Al5SbK0E4Z0EE413UyyzooSTVL
Malware Config
Signatures
-
resource yara_rule behavioral3/memory/3044-0-0x0000000010000000-0x0000000010149000-memory.dmp upx behavioral3/memory/3044-1-0x0000000010000000-0x0000000010149000-memory.dmp upx behavioral3/memory/3044-2-0x0000000010000000-0x0000000010149000-memory.dmp upx behavioral3/memory/3044-4-0x0000000010000000-0x0000000010149000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2480 wrote to memory of 3044 2480 rundll32.exe 29 PID 2480 wrote to memory of 3044 2480 rundll32.exe 29 PID 2480 wrote to memory of 3044 2480 rundll32.exe 29 PID 2480 wrote to memory of 3044 2480 rundll32.exe 29 PID 2480 wrote to memory of 3044 2480 rundll32.exe 29 PID 2480 wrote to memory of 3044 2480 rundll32.exe 29 PID 2480 wrote to memory of 3044 2480 rundll32.exe 29