Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 20:37

General

  • Target

    c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll

  • Size

    13KB

  • MD5

    a397e2989cf4a7dbef17c09e12922210

  • SHA1

    9435ae12430302149d7fab500a3727452e8731d6

  • SHA256

    c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5

  • SHA512

    552b4740d3c6c589bb1847ed7ee497383503389e44718f95e7615a94aae25c9b97ba58de1d33eff3235f3d02b86a51c507c4693e18dbc1882f1b4ab4cadb0d72

  • SSDEEP

    192:KJp8RZwYPDLRG8GmCcmcSVSWKGYAxGwCMrpY7Y8LqPZo5LdCfffnMO3Eg:sMZBRG8GmCcNcSWKGYAxGr6+Y9PffPzn

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c38ff61d4c49b5ac3a074c03b6f6807990b42000ec625e3e924c5224798fbfc5.dll,#1
      2⤵
        PID:4896

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4896-133-0x0000000010000000-0x0000000010009000-memory.dmp

      Filesize

      36KB