Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
25b204ca29adcff5aa633ab3b8f598861d26932a5373f32ededb42b9b773a8da.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
25b204ca29adcff5aa633ab3b8f598861d26932a5373f32ededb42b9b773a8da.dll
Resource
win10v2004-20220901-en
General
-
Target
25b204ca29adcff5aa633ab3b8f598861d26932a5373f32ededb42b9b773a8da.dll
-
Size
139KB
-
MD5
0006e44911b7c3986bd87d17cdc7fdf0
-
SHA1
1e0baf2066e55720890b77f1b86e8e74b68c338d
-
SHA256
25b204ca29adcff5aa633ab3b8f598861d26932a5373f32ededb42b9b773a8da
-
SHA512
ef14137f9fd0f4e5186e4b0099224b17c5edcde8ad5f2ff4ef85e18bd5189aac4abd310ce9d60ff02a7485ec9ce9bafe9766f3f844aa1dcaa533b2d61da842c2
-
SSDEEP
3072:jsgwErMSgovYOT/0OQ806pKbwXSuy8leMlVE0VA6pG0IDG:jsgyljwUqr+KAM
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4852 4708 rundll32.exe 82 PID 4708 wrote to memory of 4852 4708 rundll32.exe 82 PID 4708 wrote to memory of 4852 4708 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\25b204ca29adcff5aa633ab3b8f598861d26932a5373f32ededb42b9b773a8da.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\25b204ca29adcff5aa633ab3b8f598861d26932a5373f32ededb42b9b773a8da.dll,#12⤵PID:4852
-