Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
5978e3504bc0a3c9c6712e33b4b515c2926aaeaf616c97b8d76aaf81fb532f79.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5978e3504bc0a3c9c6712e33b4b515c2926aaeaf616c97b8d76aaf81fb532f79.dll
Resource
win10v2004-20220812-en
General
-
Target
5978e3504bc0a3c9c6712e33b4b515c2926aaeaf616c97b8d76aaf81fb532f79.dll
-
Size
588KB
-
MD5
7682be5a42207bc0a7299f2d0d10122c
-
SHA1
64a24c8c248ab1f714d7bef4ffd06cdd5527edd0
-
SHA256
5978e3504bc0a3c9c6712e33b4b515c2926aaeaf616c97b8d76aaf81fb532f79
-
SHA512
a4d13d365f10ad6ca4a9c7b7b3d24cf168e06fe40f080abbcf5a264a26366b85730e94b10ba5477a5016d18e1bba426f31407bf8402b51b5c5c73c8ee91fa6d2
-
SSDEEP
768:aS8e8QYY2uXZ9hAVawuStKIZ+2fJcwqVETAz4HMBbsjjRGPZMoJpV:MPY2IGe7IZ+nVETAzFs1foJ3
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4836 wrote to memory of 2260 4836 regsvr32.exe 79 PID 4836 wrote to memory of 2260 4836 regsvr32.exe 79 PID 4836 wrote to memory of 2260 4836 regsvr32.exe 79
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5978e3504bc0a3c9c6712e33b4b515c2926aaeaf616c97b8d76aaf81fb532f79.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5978e3504bc0a3c9c6712e33b4b515c2926aaeaf616c97b8d76aaf81fb532f79.dll2⤵PID:2260
-