Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll
Resource
win10v2004-20220812-en
General
-
Target
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll
-
Size
124KB
-
MD5
df543a4f96291a530169ee3e6195e480
-
SHA1
98d10f992b92e63adacca0f31a8888218055714f
-
SHA256
51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b
-
SHA512
1a42bfbd85405251a4dd820633b336a2e26247f17851ea1afd32cff53d6824495e8da32edde815a9b0c2621da27ee46d2f925f2dc8c956205e3b7b8dc409a03d
-
SSDEEP
3072:zIVW/iFVbQhRDB5ollrQsAdmYKyYJpoFYdS:qWqXbAt5EllAw0
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4232 wrote to memory of 4912 4232 rundll32.exe 80 PID 4232 wrote to memory of 4912 4232 rundll32.exe 80 PID 4232 wrote to memory of 4912 4232 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51bc4172ea0c40ec0b40bbb276f7fc2dd002a0cb9451fa1a1d13f090694ba44b.dll,#12⤵PID:4912
-