Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 20:37
Behavioral task
behavioral1
Sample
c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll
Resource
win10v2004-20220812-en
General
-
Target
c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll
-
Size
13KB
-
MD5
a397e2989cf4a7dbef17c09e12922210
-
SHA1
9435ae12430302149d7fab500a3727452e8731d6
-
SHA256
c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5
-
SHA512
552b4740d3c6c589bb1847ed7ee497383503389e44718f95e7615a94aae25c9b97ba58de1d33eff3235f3d02b86a51c507c4693e18dbc1882f1b4ab4cadb0d72
-
SSDEEP
192:KJp8RZwYPDLRG8GmCcmcSVSWKGYAxGwCMrpY7Y8LqPZo5LdCfffnMO3Eg:sMZBRG8GmCcNcSWKGYAxGr6+Y9PffPzn
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4744 wrote to memory of 4896 4744 rundll32.exe 82 PID 4744 wrote to memory of 4896 4744 rundll32.exe 82 PID 4744 wrote to memory of 4896 4744 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll,#12⤵PID:4896
-