Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll
Resource
win10v2004-20220812-en
General
-
Target
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll
-
Size
1.5MB
-
MD5
3b99846b60209561d49b4b9a2f00d7ca
-
SHA1
aa944052076fec5bf563311047f8eb9cfbe5e0a1
-
SHA256
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865
-
SHA512
ba48caf6ea561a671f9a607e854d7f444b6a2145acff965f10743f7f140a257ed8c4e4e1da29a67413b6ce517c29f5544042136450b6a581fcbacd6a4a7f24c1
-
SSDEEP
24576:gM1siLftC5D7INZXY0YwmZ26F1B9SQI/UDvBtfQfnPClebXWCEFGMQBl2:p2iTtCP/Se6nP4EEFqBl2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1928 1856 rundll32.exe 82 PID 1856 wrote to memory of 1928 1856 rundll32.exe 82 PID 1856 wrote to memory of 1928 1856 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll,#12⤵PID:1928
-