Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
9552f10778dc57976e0f1da4ff57ee8245aabf32d8257e68257b38ad44bc1633.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9552f10778dc57976e0f1da4ff57ee8245aabf32d8257e68257b38ad44bc1633.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
9552f10778dc57976e0f1da4ff57ee8245aabf32d8257e68257b38ad44bc1633.dll
-
Size
4KB
-
MD5
29e67ae48822918db2f016ebd5279c00
-
SHA1
37b42424c524d486833864f51e8ccb8f13723efc
-
SHA256
9552f10778dc57976e0f1da4ff57ee8245aabf32d8257e68257b38ad44bc1633
-
SHA512
003174e473bb780eab442a177f9ef0ece4841ada950f27844d7673866ee32b5f3a1303860f558d2663cefb1c3e6c91958d975f86d0823b6e43a0898a257810f1
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3444 4892 rundll32.exe 81 PID 4892 wrote to memory of 3444 4892 rundll32.exe 81 PID 4892 wrote to memory of 3444 4892 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9552f10778dc57976e0f1da4ff57ee8245aabf32d8257e68257b38ad44bc1633.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9552f10778dc57976e0f1da4ff57ee8245aabf32d8257e68257b38ad44bc1633.dll,#12⤵PID:3444
-