Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2022, 20:18
Behavioral task
behavioral1
Sample
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll
Resource
win10v2004-20220812-en
General
-
Target
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll
-
Size
211KB
-
MD5
0812cff728905cfc0c57d6dcb23f71a5
-
SHA1
b3819e9184e9faa97eca73a433b70ca771003948
-
SHA256
e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226
-
SHA512
fd386ef3eb75d5e87f476e24df0271683b61160688fc68112d30e553e84441ac4caae6a74e7524dbf8efb3b19795095cd9228911c9c1a6814754804c7a5c5840
-
SSDEEP
6144:jE3vt8VkomMsQs66Kj0TfyVbZFhIdloSsUv2:4GV2MsQs66A0TfybFiPoSbv
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 636 wrote to memory of 1052 636 rundll32.exe 80 PID 636 wrote to memory of 1052 636 rundll32.exe 80 PID 636 wrote to memory of 1052 636 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e138aab03b96b61cc77f1b5330372c8d9dd97872d2955eb16bcb5eb942b7e226.dll,#12⤵PID:1052
-