Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
Resource
win10v2004-20220812-en
General
-
Target
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
-
Size
20KB
-
MD5
064ee2886b29169b78956133017c8736
-
SHA1
91c5c6e65356bd94c18e4ea540aa24d84f080d12
-
SHA256
b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b
-
SHA512
ad3665d21a58c008ad78a853811afd2843db8c7c1b05ca336d74639073e86737845c17a5ccd2ded951a749215cddf7bd5bd4a274d240a4c2c08d14250fa4878d
-
SSDEEP
384:E8e/FlJnjG7mmpPdEizc1Tus9mViVaVBVqVd+Ve+VqVE1:UF3njE1biTutUcvYWts
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4088 wrote to memory of 3740 4088 rundll32.exe 79 PID 4088 wrote to memory of 3740 4088 rundll32.exe 79 PID 4088 wrote to memory of 3740 4088 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#12⤵PID:3740
-