Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 14:59
Static task
static1
Behavioral task
behavioral1
Sample
2976c8daa41e2de37724f24fdee66f86e90c3fbe84cfec5074bb93515c3ddde8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2976c8daa41e2de37724f24fdee66f86e90c3fbe84cfec5074bb93515c3ddde8.dll
Resource
win10v2004-20220812-en
General
-
Target
2976c8daa41e2de37724f24fdee66f86e90c3fbe84cfec5074bb93515c3ddde8.dll
-
Size
72KB
-
MD5
6c2f64a713a76f997e01930c921638b1
-
SHA1
0708868a01b608f524cd0d02d1af2a81ebe6a8fc
-
SHA256
2976c8daa41e2de37724f24fdee66f86e90c3fbe84cfec5074bb93515c3ddde8
-
SHA512
d17a14a2e4075d8ebe9926efddf18ba289717851bbd092c25a4c0e52eb54390738685b8989551ce909a139cd2681abe520dd44c54ec5e946c88c5ee3eb0c9f01
-
SSDEEP
1536:ErLu45z0Z0Xpy7/Tmkfhp2y807nOXvyocBooErMX:ErLu4dy0XpMujyocBofrM
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 680 wrote to memory of 1180 680 rundll32.exe 82 PID 680 wrote to memory of 1180 680 rundll32.exe 82 PID 680 wrote to memory of 1180 680 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2976c8daa41e2de37724f24fdee66f86e90c3fbe84cfec5074bb93515c3ddde8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2976c8daa41e2de37724f24fdee66f86e90c3fbe84cfec5074bb93515c3ddde8.dll,#12⤵PID:1180
-