Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 23:08
Static task
static1
Behavioral task
behavioral1
Sample
c4f263e387c25eaac2bd6cdf0ff83977d902ce78dcb7a37f95135220ed7e7b3c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c4f263e387c25eaac2bd6cdf0ff83977d902ce78dcb7a37f95135220ed7e7b3c.dll
Resource
win10v2004-20220812-en
General
-
Target
c4f263e387c25eaac2bd6cdf0ff83977d902ce78dcb7a37f95135220ed7e7b3c.dll
-
Size
6KB
-
MD5
011cccfe54ad70b9a7a6c0cdcbaf0040
-
SHA1
eafcd809f244a14648a728b9cff04abee26495f9
-
SHA256
c4f263e387c25eaac2bd6cdf0ff83977d902ce78dcb7a37f95135220ed7e7b3c
-
SHA512
3d215f5ea40872f6eb64a9fc075ce9cd36d7c58b8be1728e25dc83dd907bfbf51c9fa7227bf2221c7a9fb55bf24986cdd633dd831f2b6cde88e78dbea8ea162e
-
SSDEEP
96:ZZvjzuTZExl5XLytPLu5AdKaEkpp7UoqvE4ry:4g5mtThQtup7tqE4
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5040 wrote to memory of 3824 5040 rundll32.exe 80 PID 5040 wrote to memory of 3824 5040 rundll32.exe 80 PID 5040 wrote to memory of 3824 5040 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4f263e387c25eaac2bd6cdf0ff83977d902ce78dcb7a37f95135220ed7e7b3c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4f263e387c25eaac2bd6cdf0ff83977d902ce78dcb7a37f95135220ed7e7b3c.dll,#12⤵PID:3824
-