Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2022, 22:17
Behavioral task
behavioral1
Sample
eaecd12e5566a3447d5d087f9b833cc23f1ab5672d58e14d13dc776a986c05ea.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
eaecd12e5566a3447d5d087f9b833cc23f1ab5672d58e14d13dc776a986c05ea.dll
Resource
win10v2004-20220812-en
General
-
Target
eaecd12e5566a3447d5d087f9b833cc23f1ab5672d58e14d13dc776a986c05ea.dll
-
Size
64KB
-
MD5
56c6b36027112705629a47e4b8f01ded
-
SHA1
0bafe04d1b970aa149852fa38295d8850a8fdfe5
-
SHA256
eaecd12e5566a3447d5d087f9b833cc23f1ab5672d58e14d13dc776a986c05ea
-
SHA512
0e9d791d2b8e477348553c1affb5df7bcb629ed9f2b01624a64268a18997700a90ba82d9c973e2dcb99aa69305541a69e363a245df65be52406a7796e8331591
-
SSDEEP
1536:x9AVRU28lwJWEcySErbCA8ooocfx2MAG/sJz8CRRbzVLzv:x9AV628yJWEcyJrGA9ooGzp/st8CRV5H
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4972 wrote to memory of 4936 4972 rundll32.exe 35 PID 4972 wrote to memory of 4936 4972 rundll32.exe 35 PID 4972 wrote to memory of 4936 4972 rundll32.exe 35
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eaecd12e5566a3447d5d087f9b833cc23f1ab5672d58e14d13dc776a986c05ea.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eaecd12e5566a3447d5d087f9b833cc23f1ab5672d58e14d13dc776a986c05ea.dll,#12⤵PID:4936
-