Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
Resource
win10v2004-20220812-en
General
-
Target
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
-
Size
343KB
-
MD5
664d6e7b21d44375d158d70548f35cbe
-
SHA1
d2734b774b18c6aefb2c420fafbf2cf8c7997a96
-
SHA256
68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee
-
SHA512
08915f8c3055a4db327ba553614090661b5467cd0a5c929895bea0988fbc4775a5b5a9723732fe266913551d43924f0a0a0d1159cab1594d00fd78c83c3959fa
-
SSDEEP
3072:R/+JR2BNtlt0ntfjNOVzV5kqTX0nj5XEAprAgSJUJP28ZulWsXbds:R/+JR2BNtlt0trN1nhEApkggqPHZLZ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4872 4904 rundll32.exe 81 PID 4904 wrote to memory of 4872 4904 rundll32.exe 81 PID 4904 wrote to memory of 4872 4904 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#12⤵PID:4872
-