Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
30/11/2022, 22:57 UTC
General
-
Target
b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll
-
Size
18KB
-
MD5
bb991ec29a6e275e2a30f8308bd00ce4
-
SHA1
39171b62a2552203f52759ffc9004fad7b4ea84c
-
SHA256
b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b
-
SHA512
0160b5efe1adced898b811d32fdf19cc87576dcd011e61fda87d6688ac6692c56ed57d452274a04e1a9a8d065645a3fb2a545409059ed1aef1e0f5a0818fb42d
-
SSDEEP
384:EiBHo7xX9iGgOa7Pfp+/BRiBZWG5VL3ArCQBY+B7TUXiaPO7DfkKD:EP7TiGgH7PR8BnKVL3T+B7gXXPwkm
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll,#12⤵
-
Network
-
DNS14.110.152.52.in-addr.arpaRemote address:8.8.8.8:53Request14.110.152.52.in-addr.arpaIN PTRResponse
-
72.21.81.240:80
-
72.21.81.240:80
-
104.80.225.205:443
-
20.189.173.11:443
-
72.21.81.240:80
-
72.21.81.240:80
-
72.21.81.240:80
-
8.8.8.8:5314.110.152.52.in-addr.arpadns
DNS Request
14.110.152.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
256KB