Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 02:23
Behavioral task
behavioral1
Sample
83ac9208001d0c5524b342f98e9a5e78285c9b0404f9229837f066394bfb150b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
83ac9208001d0c5524b342f98e9a5e78285c9b0404f9229837f066394bfb150b.dll
Resource
win10v2004-20220812-en
General
-
Target
83ac9208001d0c5524b342f98e9a5e78285c9b0404f9229837f066394bfb150b.dll
-
Size
49KB
-
MD5
eff0f902e8a52517b0fb7c165e6f88b0
-
SHA1
e55380675bb56aa34b5419f34757ee32f0d3e69b
-
SHA256
83ac9208001d0c5524b342f98e9a5e78285c9b0404f9229837f066394bfb150b
-
SHA512
226e89e275822ec6b8438f5878b743061f4b7cba36e347274f4d308e8ee19fb7d1722dbb09c3bab5b2a67972ab7354eca2066564ecf7e2bd21f7f9d63c072ef0
-
SSDEEP
768:9xBtKtqyLUBFsNe6oR+PfjRjpubJBiCmaiOzO39MzvUSnOy32/LM1st:9RIe6oR+PfNNmDiAPz3OymLM1st
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4596 wrote to memory of 688 4596 rundll32.exe 81 PID 4596 wrote to memory of 688 4596 rundll32.exe 81 PID 4596 wrote to memory of 688 4596 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83ac9208001d0c5524b342f98e9a5e78285c9b0404f9229837f066394bfb150b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83ac9208001d0c5524b342f98e9a5e78285c9b0404f9229837f066394bfb150b.dll,#12⤵PID:688
-