Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 03:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4184e20644c70fab3fc352d015d2c530N.dll
Resource
win7-20240704-en
2 signatures
120 seconds
Behavioral task
behavioral2
Sample
4184e20644c70fab3fc352d015d2c530N.dll
Resource
win10v2004-20240709-en
2 signatures
120 seconds
General
-
Target
4184e20644c70fab3fc352d015d2c530N.dll
-
Size
4.6MB
-
MD5
4184e20644c70fab3fc352d015d2c530
-
SHA1
98173dd5e326aed634db2ac9f7061e728f92ba9a
-
SHA256
b9e01a4aba2cfa6964d82055a42405a22ab11d8888842d6381884a04532aa946
-
SHA512
88529775f6c60527511a2214619286ab5b5145350e54e5cba7519992a7a4927c3a344e631a8d87e89ee395f2cda1e1f4df5dbdcbebcf3a5d17fbb2f4764716fb
-
SSDEEP
98304:NPMvLNHzP6JliHXLa41RaywJkwon+AoQ69fYWF8irG4FjXLPM:NiiMHr1R12kOAFSYAhHXLk
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2112 rundll32.exe 2112 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2112 2392 rundll32.exe 30 PID 2392 wrote to memory of 2112 2392 rundll32.exe 30 PID 2392 wrote to memory of 2112 2392 rundll32.exe 30 PID 2392 wrote to memory of 2112 2392 rundll32.exe 30 PID 2392 wrote to memory of 2112 2392 rundll32.exe 30 PID 2392 wrote to memory of 2112 2392 rundll32.exe 30 PID 2392 wrote to memory of 2112 2392 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4184e20644c70fab3fc352d015d2c530N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4184e20644c70fab3fc352d015d2c530N.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112
-