Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll
Resource
win10v2004-20220812-en
General
-
Target
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll
-
Size
86KB
-
MD5
27c42d1ede412ef7d91405eaeb6b0a84
-
SHA1
0058af1c26e9a53ac059f48a15a6452d606d64ad
-
SHA256
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3
-
SHA512
c9468fff3593fa6fa096f88d3d9a261259b601487d66ed3029ac693baac2ba1ec08025e7fd4b2cb5aaeb820b5f01053bb38249477dee68dd1bc47db61c12b444
-
SSDEEP
1536:E7fzY+VfUJ2v+CERq46Ji79LtXA+ZpgCiIQMOxpx8i:mLYQfUG+rR2G58Mqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1880 wrote to memory of 220 1880 rundll32.exe 79 PID 1880 wrote to memory of 220 1880 rundll32.exe 79 PID 1880 wrote to memory of 220 1880 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll,#12⤵PID:220
-