Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 02:16
Static task
static1
Behavioral task
behavioral1
Sample
c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
3eb4cd50dcb9f5981f5408578cb7fb70
-
SHA1
13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
-
SHA256
1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
-
SHA512
5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
-
SSDEEP
96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1960 1940 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1940 2348 rundll32.exe 30 PID 2348 wrote to memory of 1940 2348 rundll32.exe 30 PID 2348 wrote to memory of 1940 2348 rundll32.exe 30 PID 2348 wrote to memory of 1940 2348 rundll32.exe 30 PID 2348 wrote to memory of 1940 2348 rundll32.exe 30 PID 2348 wrote to memory of 1940 2348 rundll32.exe 30 PID 2348 wrote to memory of 1940 2348 rundll32.exe 30 PID 1940 wrote to memory of 1960 1940 rundll32.exe 31 PID 1940 wrote to memory of 1960 1940 rundll32.exe 31 PID 1940 wrote to memory of 1960 1940 rundll32.exe 31 PID 1940 wrote to memory of 1960 1940 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 2243⤵
- Program crash
PID:1960
-
-