Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
c68129d7fdb0e55c9eac884de7e9a3a08faee7b9bd51d5ca89dbdd7f650d4dc1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c68129d7fdb0e55c9eac884de7e9a3a08faee7b9bd51d5ca89dbdd7f650d4dc1.dll
Resource
win10v2004-20220812-en
General
-
Target
c68129d7fdb0e55c9eac884de7e9a3a08faee7b9bd51d5ca89dbdd7f650d4dc1.dll
-
Size
137KB
-
MD5
0c1126f98d6cde8efe723865e3797160
-
SHA1
0d9e333c6509b99f353e52abfc06c860d3a8820d
-
SHA256
c68129d7fdb0e55c9eac884de7e9a3a08faee7b9bd51d5ca89dbdd7f650d4dc1
-
SHA512
8474bd871c655d527e22a10f05becaa0fb7e2620d9ec3556ec0e53d28313ae7d1ba8375819d5fe70a4b361848340f824cdbac440bcbf7000087d0445ac0b38eb
-
SSDEEP
3072:S8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxn0ILi:S8w6D4Kotup0LWI+fQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3496 1044 rundll32.exe 29 PID 1044 wrote to memory of 3496 1044 rundll32.exe 29 PID 1044 wrote to memory of 3496 1044 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c68129d7fdb0e55c9eac884de7e9a3a08faee7b9bd51d5ca89dbdd7f650d4dc1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c68129d7fdb0e55c9eac884de7e9a3a08faee7b9bd51d5ca89dbdd7f650d4dc1.dll,#12⤵PID:3496
-