Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2022, 20:20
Behavioral task
behavioral1
Sample
3f73d36c8fc89a6e09892afd2c88522da1e9ea1801d0d6dc1b359b2bc90c7565.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3f73d36c8fc89a6e09892afd2c88522da1e9ea1801d0d6dc1b359b2bc90c7565.dll
Resource
win10v2004-20220812-en
General
-
Target
3f73d36c8fc89a6e09892afd2c88522da1e9ea1801d0d6dc1b359b2bc90c7565.dll
-
Size
561KB
-
MD5
10dd3e4077f865bfdcb3785bcc6fe94c
-
SHA1
60b509d338802799d1a1799a53a55e9ecb73fece
-
SHA256
3f73d36c8fc89a6e09892afd2c88522da1e9ea1801d0d6dc1b359b2bc90c7565
-
SHA512
0c84108e05d1498ce6ffe0592b260120c85c1748257706d4fda26b38d209e27485b471b003fb69d00fef75c1e374c0bcf0bb44b677582f475fe5e6e766f30ab2
-
SSDEEP
12288:1KyRryyYn8y6N5hOiKTlDofUd1+JGS3lyisbaU:U2WyYnOZKT6a1gGS3lyie
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3444 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1568 wrote to memory of 3444 1568 rundll32.exe 81 PID 1568 wrote to memory of 3444 1568 rundll32.exe 81 PID 1568 wrote to memory of 3444 1568 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f73d36c8fc89a6e09892afd2c88522da1e9ea1801d0d6dc1b359b2bc90c7565.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f73d36c8fc89a6e09892afd2c88522da1e9ea1801d0d6dc1b359b2bc90c7565.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3444
-