Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 02:22
Static task
static1
Behavioral task
behavioral1
Sample
4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll
Resource
win10v2004-20220901-en
General
-
Target
4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll
-
Size
73KB
-
MD5
5e5209396c37957e9be9a20103db606b
-
SHA1
32d0619cacf0484f35100b35058889bcfcc4745b
-
SHA256
4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c
-
SHA512
4c95f9bf86ee5317deccf48c787d044257e2a9f60a5370f7939e46aef60d977890d8ff16dd6dcdad295445d7bb6eb4716370fd047cbe34d659837c0ae16fd4b5
-
SSDEEP
1536:Frm4jQ66HFAvGFb7e+MkAWQ0NoYhobUo9+v95TrA2UEe4Z8E4yqyot1E:tm0yGm+gAWQ+hHokF5Y2UDi8E4yTot1E
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 640 wrote to memory of 1500 640 rundll32.exe 82 PID 640 wrote to memory of 1500 640 rundll32.exe 82 PID 640 wrote to memory of 1500 640 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll,#12⤵PID:1500
-