Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 04:23
Behavioral task
behavioral1
Sample
83e7a7d4aebbad92480a593310ae48203064cc85f08ae50898c61861aa2dff13.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
83e7a7d4aebbad92480a593310ae48203064cc85f08ae50898c61861aa2dff13.dll
Resource
win10v2004-20220901-en
General
-
Target
83e7a7d4aebbad92480a593310ae48203064cc85f08ae50898c61861aa2dff13.dll
-
Size
61KB
-
MD5
689d32966bd309808527df3867e65aaa
-
SHA1
0334dd74f4e34df03f45f0b62e5ceeb39108f2bb
-
SHA256
83e7a7d4aebbad92480a593310ae48203064cc85f08ae50898c61861aa2dff13
-
SHA512
ebdbf675424e9fa793279b27b3f6d9151cd47d601d1c3f166c70cec0dded2ef770fa66e8a21c0f308d69a7e550de38e6c7099aa8c12e45d707395697ca7d2da0
-
SSDEEP
1536:RVdV8vp+HSZVuySPmu7Oc6LqZEIPYtX70M:Tdw+HSAykOTqZEIPYlh
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4800 1188 rundll32.exe 82 PID 1188 wrote to memory of 4800 1188 rundll32.exe 82 PID 1188 wrote to memory of 4800 1188 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83e7a7d4aebbad92480a593310ae48203064cc85f08ae50898c61861aa2dff13.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83e7a7d4aebbad92480a593310ae48203064cc85f08ae50898c61861aa2dff13.dll,#12⤵PID:4800
-