Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
9633bdbfa8c4d08d72ab67147e7d5e35fb43defa33d5c9386eb39e55e115ceec.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9633bdbfa8c4d08d72ab67147e7d5e35fb43defa33d5c9386eb39e55e115ceec.dll
Resource
win10v2004-20220812-en
General
-
Target
9633bdbfa8c4d08d72ab67147e7d5e35fb43defa33d5c9386eb39e55e115ceec.dll
-
Size
5KB
-
MD5
8f833904cb447f6fc1b783e1c39849d0
-
SHA1
05c98b023ff30b65d1a180564720c3fd254becff
-
SHA256
9633bdbfa8c4d08d72ab67147e7d5e35fb43defa33d5c9386eb39e55e115ceec
-
SHA512
accf9c091f9e560655eb46a8a9e5269af166e7c5bde671bb8179b5324b0861272457f317fd1aa91a6e543ab38b64070b4fb302f1b5a1af7ba091c3c766b07949
-
SSDEEP
48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXr7dOWGE:1h9jTqMMrY0OI/KYyznSMXeE
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 792 wrote to memory of 4772 792 rundll32.exe 79 PID 792 wrote to memory of 4772 792 rundll32.exe 79 PID 792 wrote to memory of 4772 792 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9633bdbfa8c4d08d72ab67147e7d5e35fb43defa33d5c9386eb39e55e115ceec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9633bdbfa8c4d08d72ab67147e7d5e35fb43defa33d5c9386eb39e55e115ceec.dll,#12⤵PID:4772
-