Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll
Resource
win10v2004-20220812-en
General
-
Target
8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll
-
Size
116KB
-
MD5
0c89adaabcafa265ca5f55e51da3c4e0
-
SHA1
07a391d3162a7d962e3f8981d8b386e960239d9b
-
SHA256
8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504
-
SHA512
70a891032584aff43e18029533065c4168bda1604419cbd6579693c8ec45b516a40fafc051069e0f4c0c536371f071107900ab08e41e6d9b2af662330aeef72c
-
SSDEEP
1536:zyY8wugEwOVEXdz70e4gIWCnFTRT3TmXObEcskCpSzgxvFW3vsv5brSNJ6w:zyKF70e4gBWFkXObjex9wsBbu0w
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4532 wrote to memory of 2220 4532 rundll32.exe 79 PID 4532 wrote to memory of 2220 4532 rundll32.exe 79 PID 4532 wrote to memory of 2220 4532 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll,#12⤵PID:2220
-