Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
184s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll
Resource
win10v2004-20220812-en
General
-
Target
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll
-
Size
132KB
-
MD5
1a6390ec5e3c8c9851396cb2dae5295c
-
SHA1
2b12bf4ed6742f3fbded0aba94c6ab6311e2c72c
-
SHA256
8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848
-
SHA512
7064955f29a2e32870fe0a89a656ec43d074aa27f6fb9378a1ce05d7060c01685ecd3a5b59a88a811da4b5fd01ab048963bc66b6398749582da061dba0302b23
-
SSDEEP
3072:3ffqwt4wIqYhb5tgL6TcI6xQcgDmDQV7xmM0pI5aghOjRFlkHGe2:3KweW00Latn7MZI5XOjH
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4480 4692 rundll32.exe 81 PID 4692 wrote to memory of 4480 4692 rundll32.exe 81 PID 4692 wrote to memory of 4480 4692 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ddee7d5a1078020111f2f3caa0cc519d022ab2c2a7ab7b216248264d4bf4848.dll,#12⤵PID:4480
-