Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2025, 20:57 UTC

General

  • Target

    2784b8f3dbd17ce668cffe0c621d7db2c51b7bfc8f05127d6682557afb5b05fa.dll

  • Size

    76KB

  • MD5

    fbb4358cbea575cd8ed9192031ef35d3

  • SHA1

    1d4c5dab15c0548b4f35f68c156647e37a733259

  • SHA256

    2784b8f3dbd17ce668cffe0c621d7db2c51b7bfc8f05127d6682557afb5b05fa

  • SHA512

    a346ec8ce3a12377b2c0cfe624f45491f901cab86e1fdf289d20e1ed02b5ac9a2733b9e4c66562ff62d9913911a5239bd4cb6dfc287c31ca1b183395c29f9be4

  • SSDEEP

    1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zq+0Ug:c8y93KQjy7G55riF1cMo03k+5g

Score
5/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2784b8f3dbd17ce668cffe0c621d7db2c51b7bfc8f05127d6682557afb5b05fa.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2784b8f3dbd17ce668cffe0c621d7db2c51b7bfc8f05127d6682557afb5b05fa.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 308
        3⤵
        • Program crash
        PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2060-0-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2060-1-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.