Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
e0757cca146cd67503f62957b2946a5b85a3acf2214f03de1fa69efa4689688c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e0757cca146cd67503f62957b2946a5b85a3acf2214f03de1fa69efa4689688c.dll
Resource
win10v2004-20220901-en
General
-
Target
e0757cca146cd67503f62957b2946a5b85a3acf2214f03de1fa69efa4689688c.dll
-
Size
100KB
-
MD5
91c689dd27506967b525fdc6c1a36f1f
-
SHA1
8a99ff6b2091dab91d8815810fe9535073a71097
-
SHA256
e0757cca146cd67503f62957b2946a5b85a3acf2214f03de1fa69efa4689688c
-
SHA512
a9b1205aad2ef9a3e29332bc366b640408cee8f5cdc01c7764cef65cba5387b7cddde32d5d518360075c3b168be35ecb5227f8fec212be0a94660dd80367b971
-
SSDEEP
1536:JzpxQaklLkdbbCzJ7VyzypXbPvt/eZHcpUAIznWcLKf67OWugLrppF:JmlLEDAIznZKCoYd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3368 wrote to memory of 4300 3368 rundll32.exe 84 PID 3368 wrote to memory of 4300 3368 rundll32.exe 84 PID 3368 wrote to memory of 4300 3368 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e0757cca146cd67503f62957b2946a5b85a3acf2214f03de1fa69efa4689688c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e0757cca146cd67503f62957b2946a5b85a3acf2214f03de1fa69efa4689688c.dll,#12⤵PID:4300
-