Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 08:15
Static task
static1
Behavioral task
behavioral1
Sample
3e58d3411c219defbf214d389775a49a8c10c7c4b1ccd63beee5c24d63123f65.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3e58d3411c219defbf214d389775a49a8c10c7c4b1ccd63beee5c24d63123f65.dll
Resource
win10v2004-20220812-en
General
-
Target
3e58d3411c219defbf214d389775a49a8c10c7c4b1ccd63beee5c24d63123f65.dll
-
Size
130KB
-
MD5
64c3995e56d8f4e9676680491a6ef12a
-
SHA1
c22e459cdcf288a47280c9e3e9f35c3d8636d68e
-
SHA256
3e58d3411c219defbf214d389775a49a8c10c7c4b1ccd63beee5c24d63123f65
-
SHA512
50f42cc5492db06dfb633ac47794fe65b00622167839607dc3e2c3f8f5b095160f9ec7f94d43f79a4adbfa39fef06c45f6913fdd57025116ddec310c0ef01a37
-
SSDEEP
1536:NIROHhy6BTc69lp6LteOBUtyx6CSa9Tadc7jHlK8WnVniD:NCohy6BTJ8QOIybpTccPw8WnVniD
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\1F2522E6.sys rundll32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4340 wrote to memory of 3400 4340 rundll32.exe 79 PID 4340 wrote to memory of 3400 4340 rundll32.exe 79 PID 4340 wrote to memory of 3400 4340 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e58d3411c219defbf214d389775a49a8c10c7c4b1ccd63beee5c24d63123f65.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e58d3411c219defbf214d389775a49a8c10c7c4b1ccd63beee5c24d63123f65.dll,#12⤵
- Drops file in System32 directory
PID:3400
-