Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll
-
Size
40KB
-
MD5
04eb8c4b042211d7b4cbd053a1c9c480
-
SHA1
70922d865ff95141b287d94bf41933ed58c59b12
-
SHA256
03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454
-
SHA512
06ea126edf4eb160503ef0f0de606c1316cc0fd16b0da34ea63e51b51647f0feb7c02a6cdcc665b9d242717857a94d51815edc97c2be3bf618de1aac824fc1b1
-
SSDEEP
768:H+ZRMl2iz3EdxQGFSxGkT2m3Ta0VNaopWNLwTDQVbDaIgstH+:eZRMkiz3EdxVFwGG2m3TZuopWNLwTMek
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe 3620 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1976 wrote to memory of 3620 1976 rundll32.exe 82 PID 1976 wrote to memory of 3620 1976 rundll32.exe 82 PID 1976 wrote to memory of 3620 1976 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\03093fed696457b1882fbd08655132e84664a8058c047b79d5489e923803a454.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:3620
-