Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 17:05
Static task
static1
Behavioral task
behavioral1
Sample
8851558bb2ca15adf67778803d109bc115114876758ad1e22b9816f24838caf8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8851558bb2ca15adf67778803d109bc115114876758ad1e22b9816f24838caf8.dll
Resource
win10v2004-20220812-en
General
-
Target
8851558bb2ca15adf67778803d109bc115114876758ad1e22b9816f24838caf8.dll
-
Size
143KB
-
MD5
2d3bd2a3c1396267dc37dff855de54ea
-
SHA1
f876b4e5c64753c25ba223db774bacc751c14eec
-
SHA256
8851558bb2ca15adf67778803d109bc115114876758ad1e22b9816f24838caf8
-
SHA512
6672dba587964ceae7d3dca3c27ee7567c722d238ac7a5482ad359a2516a455e227a46c43f13b9c56541852a96b432b38b716cc0a3fdf835deeb0ca75b1881ea
-
SSDEEP
3072:MHC2eKQ/MQUASCVi3ipiQ1rvSnUCGEmeRmgNtgy:MHzV3ipiQaGEmEm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1144 wrote to memory of 2188 1144 rundll32.exe 81 PID 1144 wrote to memory of 2188 1144 rundll32.exe 81 PID 1144 wrote to memory of 2188 1144 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8851558bb2ca15adf67778803d109bc115114876758ad1e22b9816f24838caf8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8851558bb2ca15adf67778803d109bc115114876758ad1e22b9816f24838caf8.dll,#12⤵PID:2188
-