Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 06:22
Behavioral task
behavioral1
Sample
17a8d5f8e75a8e90653662b8206a06c037ece97447b6ded1246517e605f39e55.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
17a8d5f8e75a8e90653662b8206a06c037ece97447b6ded1246517e605f39e55.dll
Resource
win10v2004-20220901-en
General
-
Target
17a8d5f8e75a8e90653662b8206a06c037ece97447b6ded1246517e605f39e55.dll
-
Size
96KB
-
MD5
7043e27cb2c90e413b47990d00faa03f
-
SHA1
859bcd37866d370195d9fad3e7f9bebcc71cbfc2
-
SHA256
17a8d5f8e75a8e90653662b8206a06c037ece97447b6ded1246517e605f39e55
-
SHA512
37656d8f2a9773bde1cbf0bb69635c6d7cef9e61f2320e14d6c00cad15200c4490643028cc64766c65cc5cb7569667e93ff87439e9b5f6db592b3ff1c5fe042a
-
SSDEEP
1536:uLagGKilBnQ0qS89xsYT7+++qjbO2Qb9WaTO40GgGkjnPIQoq:+aXlrqP9NT7N+qjbO2Qb9akjQoq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2260 wrote to memory of 1856 2260 rundll32.exe 10 PID 2260 wrote to memory of 1856 2260 rundll32.exe 10 PID 2260 wrote to memory of 1856 2260 rundll32.exe 10
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17a8d5f8e75a8e90653662b8206a06c037ece97447b6ded1246517e605f39e55.dll,#11⤵PID:1856
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17a8d5f8e75a8e90653662b8206a06c037ece97447b6ded1246517e605f39e55.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2260