Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll
Resource
win10v2004-20220901-en
General
-
Target
198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll
-
Size
30KB
-
MD5
0ab375d32d0c2f2cffb9a838b63c3a3b
-
SHA1
84d444a73365bf1db25f03ea62d10646cd1e511b
-
SHA256
198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01
-
SHA512
ea0d5f19cfbc9e6543c6647d22ba4ec0078c98841dc1f4ed5a54282e2bebd25e2836717213fd91453c5028b710aea4807b0b5d62e8d013770bf8857c3a25674b
-
SSDEEP
768:VLM8JjlVmlQIHTRF8id6jYT4t6XjWdlPP:VLnjlVm/TAYEICd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2748 wrote to memory of 4416 2748 regsvr32.exe 82 PID 2748 wrote to memory of 4416 2748 regsvr32.exe 82 PID 2748 wrote to memory of 4416 2748 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll2⤵PID:4416
-