Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
4b43866ee498c625227a4f49ed00dfe4a3ded475d4634233a0bdc7ad80b7e012.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4b43866ee498c625227a4f49ed00dfe4a3ded475d4634233a0bdc7ad80b7e012.dll
Resource
win10v2004-20220812-en
General
-
Target
4b43866ee498c625227a4f49ed00dfe4a3ded475d4634233a0bdc7ad80b7e012.dll
-
Size
7KB
-
MD5
6b2cb94ec6a2823c59144ca788a1a4f0
-
SHA1
0c79e96803ed5bc75a67928e337e8f4aa2663ea4
-
SHA256
4b43866ee498c625227a4f49ed00dfe4a3ded475d4634233a0bdc7ad80b7e012
-
SHA512
d3bb6c3014147751de9566a82bb9147f34db2410b3421848f1dbb45c4cfaf0febdc6614284f5d267a5fbf8412cd608250cac0222f988f4f9e3ebf456f3141484
-
SSDEEP
96:PmkiIz8UZrQ0MhI/ITqly9hE+S+4qlmBemysRt8jGf154+A9+K:OrIQUA/R6+D4ImBemysRmjUP3A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2424 wrote to memory of 5092 2424 rundll32.exe 80 PID 2424 wrote to memory of 5092 2424 rundll32.exe 80 PID 2424 wrote to memory of 5092 2424 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b43866ee498c625227a4f49ed00dfe4a3ded475d4634233a0bdc7ad80b7e012.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b43866ee498c625227a4f49ed00dfe4a3ded475d4634233a0bdc7ad80b7e012.dll,#12⤵PID:5092
-