Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 08:48
Behavioral task
behavioral1
Sample
cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll
Resource
win10v2004-20220901-en
General
-
Target
cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll
-
Size
67KB
-
MD5
4d16e05a1726a88d4fa54a1498d23c68
-
SHA1
d989db975b869d08850fed582476f8316a3c1993
-
SHA256
cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b
-
SHA512
25a3a38744581e726e805abe54bcd95556a583dc8273f71d7168089ac07c0d7a144c96d569e2fdc4231e66bb62a9db8aaa34dc20420e70888ce2bf0b1b8d8838
-
SSDEEP
1536:bJT7qciEXnB49tbFop8od8JW1wFlqn3XsvEfUZykuI8sfkoHL+Ji6jW6:bh+ciEXBPvJml1MMZykXlfhH4i6jW6
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4172 wrote to memory of 4708 4172 rundll32.exe 44 PID 4172 wrote to memory of 4708 4172 rundll32.exe 44 PID 4172 wrote to memory of 4708 4172 rundll32.exe 44
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll,#12⤵PID:4708
-