Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
Resource
win10v2004-20220812-en
General
-
Target
a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
-
Size
588KB
-
MD5
92243581d2086e8ae43b6af6c3dbff30
-
SHA1
4baa0a3c91388e825b8ba391254ce225caf262c8
-
SHA256
a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d
-
SHA512
84107f7948470e0d0adc81ec3bf456352d1941a76fa6886240b6a5f561ce9f89065ed1f2eb20bfc63318af04d6931c9a6e83e579e1438a893944dfda93e0bc39
-
SSDEEP
12288:dHztGB6l9ia4Lv68yoaaPu5vb+YF/zYwQm8:dJGwl9ia4Lv68yoaam5vb+u/zl
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 448 wrote to memory of 4088 448 regsvr32.exe 80 PID 448 wrote to memory of 4088 448 regsvr32.exe 80 PID 448 wrote to memory of 4088 448 regsvr32.exe 80
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll2⤵PID:4088
-