Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2022, 16:57
Behavioral task
behavioral1
Sample
a962fce73de971d300ea4998299766e4fc259d66944e031f55f24cc97645f1f9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a962fce73de971d300ea4998299766e4fc259d66944e031f55f24cc97645f1f9.dll
Resource
win10v2004-20220812-en
General
-
Target
a962fce73de971d300ea4998299766e4fc259d66944e031f55f24cc97645f1f9.dll
-
Size
56KB
-
MD5
69efda859041d7a4ee86ccac775d7866
-
SHA1
3bd843d9914c4df07752d58ac4d92dad3ae2cfe4
-
SHA256
a962fce73de971d300ea4998299766e4fc259d66944e031f55f24cc97645f1f9
-
SHA512
51589ef194a1af2b080c620ac7d31ad066d2c6dfb9f3896da21bd82f73d26f492c6b33bfbea60f5fe7d947acc1b4714692f6928cc6aea05ab6c728f37d2fe5f1
-
SSDEEP
768:qoxOMhyv2wHxC2fG8R9gi4KD6GiUiO+0YNYoBMiUgGpZ7o1oIThnKlEry:F3ox96Gj+dNexS1vhm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4492 wrote to memory of 1204 4492 rundll32.exe 81 PID 4492 wrote to memory of 1204 4492 rundll32.exe 81 PID 4492 wrote to memory of 1204 4492 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a962fce73de971d300ea4998299766e4fc259d66944e031f55f24cc97645f1f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a962fce73de971d300ea4998299766e4fc259d66944e031f55f24cc97645f1f9.dll,#12⤵PID:1204
-