Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 18:52
Behavioral task
behavioral1
Sample
3f5169b5141aa1b04aee7e4584ada2c2d7db5051ebd61036f437d89b611f63bd.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f5169b5141aa1b04aee7e4584ada2c2d7db5051ebd61036f437d89b611f63bd.dll
Resource
win10v2004-20220812-en
General
-
Target
3f5169b5141aa1b04aee7e4584ada2c2d7db5051ebd61036f437d89b611f63bd.dll
-
Size
63KB
-
MD5
0f354fc3acb203bbb0dea1a9ff3bf951
-
SHA1
1f2f22af42e345fefef52047e8c0c34ab06f3379
-
SHA256
3f5169b5141aa1b04aee7e4584ada2c2d7db5051ebd61036f437d89b611f63bd
-
SHA512
f77645d02e97ad0b0ab8c22ca526b345d32eb59c46bfbd220ffceab3649af934f5ff2b30b638c509c32f414dec1bdd581b040f25045b4fce6248889d92e0c547
-
SSDEEP
768:e+TO5SxTOEq/CRjFSuoBV5q864kBCZHIKt3095taw4ipltLflDmA0i8RFPJE/LZ:lTESkEqKwVJCC6Kt2awRjtLfNm7l4
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4596 4764 rundll32.exe 80 PID 4764 wrote to memory of 4596 4764 rundll32.exe 80 PID 4764 wrote to memory of 4596 4764 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f5169b5141aa1b04aee7e4584ada2c2d7db5051ebd61036f437d89b611f63bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f5169b5141aa1b04aee7e4584ada2c2d7db5051ebd61036f437d89b611f63bd.dll,#12⤵PID:4596
-