Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
274s -
max time network
392s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 05:25
Static task
static1
Behavioral task
behavioral1
Sample
470e42b210aa352583020d0f497df0b44f1cf5a163197b367eadfbe33512a509.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
470e42b210aa352583020d0f497df0b44f1cf5a163197b367eadfbe33512a509.dll
Resource
win10v2004-20221111-en
General
-
Target
470e42b210aa352583020d0f497df0b44f1cf5a163197b367eadfbe33512a509.dll
-
Size
137KB
-
MD5
18a62fb684063b4ea2ebe8718f247660
-
SHA1
bb3b7c3f364c67051f0805b04cbc866f27f077d1
-
SHA256
470e42b210aa352583020d0f497df0b44f1cf5a163197b367eadfbe33512a509
-
SHA512
52a298511e79b824dbbfdbee8c4b5e34484e5e5d5394194a76bdc6ef8fac19388d06ec3376b2e07026ff5dae78e71c47854e67b77750b902910310c747c8cceb
-
SSDEEP
3072:q8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXx20ILe:q8w6D4Kotup0LWI+fj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3876 4720 rundll32.exe 78 PID 4720 wrote to memory of 3876 4720 rundll32.exe 78 PID 4720 wrote to memory of 3876 4720 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\470e42b210aa352583020d0f497df0b44f1cf5a163197b367eadfbe33512a509.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\470e42b210aa352583020d0f497df0b44f1cf5a163197b367eadfbe33512a509.dll,#12⤵PID:3876
-