Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 13:05 UTC
Static task
static1
Behavioral task
behavioral1
Sample
e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll
Resource
win10v2004-20240709-en
General
-
Target
e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll
-
Size
240KB
-
MD5
0415a495afb5e811881209cce7d496aa
-
SHA1
2cfa5822ce6607acc558091d8ea8b4344f12f72a
-
SHA256
e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce
-
SHA512
7974d4d445bbbf067c9fd4756e61fad84eb3342ee5625e685d583108bc12511bda3af2e60f479a613997f1dcc922841bfa192b9184b5367c3f3fc537e19f7e62
-
SSDEEP
3072:/Cc5B9t5RVp8r+n8thbxaCPmldQDzdjIs9OThDGpzioMQDk0496Z:qc5B9hc9hoamOdjkmkm
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GRGDTATM_CommCfg.ini rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 984 wrote to memory of 1440 984 rundll32.exe 30 PID 984 wrote to memory of 1440 984 rundll32.exe 30 PID 984 wrote to memory of 1440 984 rundll32.exe 30 PID 984 wrote to memory of 1440 984 rundll32.exe 30 PID 984 wrote to memory of 1440 984 rundll32.exe 30 PID 984 wrote to memory of 1440 984 rundll32.exe 30 PID 984 wrote to memory of 1440 984 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll,#12⤵
- Drops file in System32 directory
PID:1440
-