Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 23:17
Behavioral task
behavioral1
Sample
e5086f254762127868e057a3a9af0a5b47d1010f94c1213a89c04344ceb464aa.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e5086f254762127868e057a3a9af0a5b47d1010f94c1213a89c04344ceb464aa.dll
Resource
win10v2004-20220901-en
General
-
Target
e5086f254762127868e057a3a9af0a5b47d1010f94c1213a89c04344ceb464aa.dll
-
Size
72KB
-
MD5
0840af24c7aec74b6c3cfc90605df3d0
-
SHA1
78e7e7eef1676d020a76df065b20d475234d5ff7
-
SHA256
e5086f254762127868e057a3a9af0a5b47d1010f94c1213a89c04344ceb464aa
-
SHA512
f74205a4232d83d80fb5c23dd2d4c93e090313a84459828efa96682e64c0b87b06d8b93eb33900c30f0119d724e5892671dd4a6967a8282d72bd53b6eee99f85
-
SSDEEP
1536:LszMRUysCtjhR5l5YnchsxSYxvKDBAST8zxVR:L6PuIncCUY9KDaST8zJ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4792 wrote to memory of 2796 4792 rundll32.exe 81 PID 4792 wrote to memory of 2796 4792 rundll32.exe 81 PID 4792 wrote to memory of 2796 4792 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5086f254762127868e057a3a9af0a5b47d1010f94c1213a89c04344ceb464aa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5086f254762127868e057a3a9af0a5b47d1010f94c1213a89c04344ceb464aa.dll,#12⤵PID:2796
-