Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
280s -
max time network
347s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
f47d23591e54d9e6a3cdbd376c07f9599f5c3258cc8e35465bd3064a6371b241.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f47d23591e54d9e6a3cdbd376c07f9599f5c3258cc8e35465bd3064a6371b241.dll
Resource
win10v2004-20221111-en
General
-
Target
f47d23591e54d9e6a3cdbd376c07f9599f5c3258cc8e35465bd3064a6371b241.dll
-
Size
113KB
-
MD5
088dca58db10a0d221d0c748a4f80a5d
-
SHA1
ceb4271be24dd83eaa18c40ea6f77612904a34f1
-
SHA256
f47d23591e54d9e6a3cdbd376c07f9599f5c3258cc8e35465bd3064a6371b241
-
SHA512
d0953ad795a90e0562b4572af3e333b3f714ead9bfa618fcbba0d1766db0ac13751c53f8d62c5778faf09ca64a0d66d1a8483a15bd35bf663e7eae18c219e542
-
SSDEEP
1536:O8DCK/ldu1wNr2H3XuGcZyqJWMwSLR36EYPmrUmE4IWPc8riayAydU8363hDjyD5:1/BNr2OpZDzF3WPxANxnCU8363hDM5
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2660 2720 rundll32.exe 82 PID 2720 wrote to memory of 2660 2720 rundll32.exe 82 PID 2720 wrote to memory of 2660 2720 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f47d23591e54d9e6a3cdbd376c07f9599f5c3258cc8e35465bd3064a6371b241.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f47d23591e54d9e6a3cdbd376c07f9599f5c3258cc8e35465bd3064a6371b241.dll,#12⤵PID:2660
-