Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 21:21
Static task
static1
Behavioral task
behavioral1
Sample
45a47eb0753cdec0b825bdf3ff66aabebcd519146a6668363f469b782b87f24e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
45a47eb0753cdec0b825bdf3ff66aabebcd519146a6668363f469b782b87f24e.dll
Resource
win10v2004-20220812-en
General
-
Target
45a47eb0753cdec0b825bdf3ff66aabebcd519146a6668363f469b782b87f24e.dll
-
Size
4KB
-
MD5
0a62f5feedee2194cb01baf5a0364390
-
SHA1
65f254250058dae684ee8f2bbf37c1bd157631e0
-
SHA256
45a47eb0753cdec0b825bdf3ff66aabebcd519146a6668363f469b782b87f24e
-
SHA512
00dc32dbe7bb02cb2a9dc8c8665fdf69e99da5604d1bfd73c772743c3082b126c3d4c627b593dff97fa77b09dbc6725ff2557ec80c90b1f4d749d87759c55c66
-
SSDEEP
48:a5zdM1cSTBg0r27vTuAEKrv4d/BXtqiu1/+B/:PT3r2vu9kvCBX4iuIV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4652 wrote to memory of 2556 4652 rundll32.exe 78 PID 4652 wrote to memory of 2556 4652 rundll32.exe 78 PID 4652 wrote to memory of 2556 4652 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45a47eb0753cdec0b825bdf3ff66aabebcd519146a6668363f469b782b87f24e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45a47eb0753cdec0b825bdf3ff66aabebcd519146a6668363f469b782b87f24e.dll,#12⤵PID:2556
-