Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
5992fc17721a96948564e30e169fa1c3e456b5214edfb6f1005e25f4ffc43da1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5992fc17721a96948564e30e169fa1c3e456b5214edfb6f1005e25f4ffc43da1.dll
Resource
win10v2004-20220812-en
General
-
Target
5992fc17721a96948564e30e169fa1c3e456b5214edfb6f1005e25f4ffc43da1.dll
-
Size
12KB
-
MD5
420abb6b4ed23c872ee6e48fc4417100
-
SHA1
8a20f4b96e161b0b16f84e2caf458303fe535edb
-
SHA256
5992fc17721a96948564e30e169fa1c3e456b5214edfb6f1005e25f4ffc43da1
-
SHA512
4953e9dc26118a1dec0333fc3513259adbb8b5bca93c4b95ad40228db50087494ae0ea208dd80b622a45f074bd04e966e37b5dc414a90c388c5ad401e225eb35
-
SSDEEP
192:eba3SrEV8mNK4z5rWp/XpM5ixd5HxZE30ZDcvtG5McCcwf2WUM+K6XzKkgUw9+:UihK4Vi/C5Sd5zE94j+2WUM76zFD
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5080 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5080 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4120 wrote to memory of 5080 4120 rundll32.exe 83 PID 4120 wrote to memory of 5080 4120 rundll32.exe 83 PID 4120 wrote to memory of 5080 4120 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5992fc17721a96948564e30e169fa1c3e456b5214edfb6f1005e25f4ffc43da1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5992fc17721a96948564e30e169fa1c3e456b5214edfb6f1005e25f4ffc43da1.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5080
-