Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 20:49
Behavioral task
behavioral1
Sample
5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll
Resource
win10v2004-20220812-en
General
-
Target
5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll
-
Size
113KB
-
MD5
1cd48ca07e03ca4dd9b2a7075048c238
-
SHA1
44d70f9fd7431b0d8c6b2abced3ecec6e04d5c83
-
SHA256
5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992
-
SHA512
9707108a0de75f58e31600e423a4e6a86f6d8e79a252acd9eee0de0575eaa3e49f269d4d51de8d7cfa09e3448dfe49d6d0ac2f997b60e3f3fc7065c60bd39a4e
-
SSDEEP
1536:T8b0zyJO5R1fGyPk8zS6lglv9xs+YuVfJfQViw1jkt5PY3P6d5sXmbHDK9hqdj6U:T8Ns5HuaKlAihQ5jcxgP6b9bjK2gNz
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1548-133-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1548-134-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2816 wrote to memory of 1548 2816 rundll32.exe 82 PID 2816 wrote to memory of 1548 2816 rundll32.exe 82 PID 2816 wrote to memory of 1548 2816 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll,#12⤵PID:1548
-