Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2022, 23:43 UTC
Static task
static1
Behavioral task
behavioral1
Sample
a8a194571bf39862d2ba7d72ccba235b05a3aab4d83570e527d0c34acda2bf74.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a8a194571bf39862d2ba7d72ccba235b05a3aab4d83570e527d0c34acda2bf74.dll
Resource
win10v2004-20220812-en
General
-
Target
a8a194571bf39862d2ba7d72ccba235b05a3aab4d83570e527d0c34acda2bf74.dll
-
Size
126KB
-
MD5
9aee8f927a6402d1b50c75cb4463eb40
-
SHA1
76e538ffe4de64fab2cd23c848149f5dbbe903d6
-
SHA256
a8a194571bf39862d2ba7d72ccba235b05a3aab4d83570e527d0c34acda2bf74
-
SHA512
bbdd1ed0230a50a34d02f418f313af68edfaef40535db5dc87590bce3c200d55e00fe99c84273275689c31c94703ea16ef1d285ed7c67895253296a12ea4c9ee
-
SSDEEP
1536:GXWt3oWbAK/NFk7NTMRT+F/um7n9720ucCjtRXtJPyDP9IJ8WDF8X6n2h:GTWUshp+cm7n97HucotRXe5S8UOKS
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1932-133-0x0000000000CB0000-0x0000000000CBE000-memory.dmp upx behavioral2/memory/1932-136-0x0000000000CB0000-0x0000000000CBE000-memory.dmp upx behavioral2/memory/1932-137-0x0000000000CB0000-0x0000000000CBE000-memory.dmp upx behavioral2/memory/1932-138-0x0000000000CB0000-0x0000000000CBE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1932 4548 rundll32.exe 80 PID 4548 wrote to memory of 1932 4548 rundll32.exe 80 PID 4548 wrote to memory of 1932 4548 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8a194571bf39862d2ba7d72ccba235b05a3aab4d83570e527d0c34acda2bf74.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8a194571bf39862d2ba7d72ccba235b05a3aab4d83570e527d0c34acda2bf74.dll,#12⤵PID:1932
-