Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2022, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
44e14e0ff9d51c62f0f1fdd11b8faab241aa40eb7fc9ea3cef7af5e7aed8b823.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
44e14e0ff9d51c62f0f1fdd11b8faab241aa40eb7fc9ea3cef7af5e7aed8b823.dll
-
Size
2.1MB
-
MD5
af42df7c1350aa5890dd192d5e0e9964
-
SHA1
ac0714756f8f71e0f90927599146d599201650e1
-
SHA256
44e14e0ff9d51c62f0f1fdd11b8faab241aa40eb7fc9ea3cef7af5e7aed8b823
-
SHA512
e6136ce8bf26a241b5c3bc22efab42ee93ca507c23e0cf9e349808584f67edaed100d5fff9a07a192d29a68224a55ac1603b99e7cbf521bc1096436de03c8223
-
SSDEEP
24576:Ct/9Fh821Zotk41+4npC28FJngG1feE8+o8cUwsnKcXI5r/BZle28V69hZy4/HX0:Ct/fCcbT8U3xY5zBx8A9X7zgOCo43
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4236 wrote to memory of 3068 4236 rundll32.exe 78 PID 4236 wrote to memory of 3068 4236 rundll32.exe 78 PID 4236 wrote to memory of 3068 4236 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44e14e0ff9d51c62f0f1fdd11b8faab241aa40eb7fc9ea3cef7af5e7aed8b823.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44e14e0ff9d51c62f0f1fdd11b8faab241aa40eb7fc9ea3cef7af5e7aed8b823.dll,#12⤵PID:3068
-