Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 23:15
Behavioral task
behavioral1
Sample
8023ebb3665877d47523fe26e08ef92359262ecdc702f2cf1e56cbfffb0a00d3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8023ebb3665877d47523fe26e08ef92359262ecdc702f2cf1e56cbfffb0a00d3.dll
Resource
win10v2004-20220901-en
General
-
Target
8023ebb3665877d47523fe26e08ef92359262ecdc702f2cf1e56cbfffb0a00d3.dll
-
Size
67KB
-
MD5
31f139b31be7527af593dd117fe098f0
-
SHA1
341ec6bd92abc10983d3f26dfe67a8d48fcf8c0f
-
SHA256
8023ebb3665877d47523fe26e08ef92359262ecdc702f2cf1e56cbfffb0a00d3
-
SHA512
5af75ab115a6a77b39e03b16cbdddfa4ffbe66dcb488f13f2e058b57ba6afd352b540ae338ec223c87959c4eb2d218791542d76692a806d6889372c33b20b7f1
-
SSDEEP
1536:Bm1NGJVG2M9pXQBnxUGLLcEa7DYGZM9/6mMSf:kX0V1M9uhxUG/yDFA/uSf
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4792 wrote to memory of 4652 4792 rundll32.exe 83 PID 4792 wrote to memory of 4652 4792 rundll32.exe 83 PID 4792 wrote to memory of 4652 4792 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8023ebb3665877d47523fe26e08ef92359262ecdc702f2cf1e56cbfffb0a00d3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8023ebb3665877d47523fe26e08ef92359262ecdc702f2cf1e56cbfffb0a00d3.dll,#12⤵PID:4652
-