Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 05:03
Behavioral task
behavioral1
Sample
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll
-
Size
701KB
-
MD5
37e927d1822f3754edf93669ba2b96c0
-
SHA1
0cbff93be9f7a11781d4e71fb8520168b481338b
-
SHA256
39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60
-
SHA512
56e432d997e0e59692ff154197a8eb330a00d2873f5f1b7e8f73675ca341f569f311e3ad5f9589b714929042c495849b34b3c2d74df9c589a6ed517e1e199ac2
-
SSDEEP
12288:IiTAZSaeC0bAKAWwmgFVPreOeM2WmQw3jKX8/PKXB:xTdQcAKAW3UrefM2WmQIsgK
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 52 4820 rundll32.exe 63 4820 rundll32.exe 73 4820 rundll32.exe 90 4820 rundll32.exe 103 4820 rundll32.exe 104 4820 rundll32.exe 105 4820 rundll32.exe 106 4820 rundll32.exe 107 4820 rundll32.exe 108 4820 rundll32.exe 109 4820 rundll32.exe 112 4820 rundll32.exe 113 4820 rundll32.exe 114 4820 rundll32.exe 115 4820 rundll32.exe 117 4820 rundll32.exe 119 4820 rundll32.exe 121 4820 rundll32.exe 122 4820 rundll32.exe 123 4820 rundll32.exe 124 4820 rundll32.exe 125 4820 rundll32.exe 126 4820 rundll32.exe 127 4820 rundll32.exe 128 4820 rundll32.exe 129 4820 rundll32.exe 130 4820 rundll32.exe 131 4820 rundll32.exe 132 4820 rundll32.exe 133 4820 rundll32.exe 134 4820 rundll32.exe 135 4820 rundll32.exe 136 4820 rundll32.exe 137 4820 rundll32.exe 138 4820 rundll32.exe 139 4820 rundll32.exe 140 4820 rundll32.exe 141 4820 rundll32.exe 142 4820 rundll32.exe 143 4820 rundll32.exe 144 4820 rundll32.exe 145 4820 rundll32.exe 146 4820 rundll32.exe 147 4820 rundll32.exe 148 4820 rundll32.exe 149 4820 rundll32.exe 150 4820 rundll32.exe 151 4820 rundll32.exe 152 4820 rundll32.exe 153 4820 rundll32.exe 154 4820 rundll32.exe 155 4820 rundll32.exe 156 4820 rundll32.exe 157 4820 rundll32.exe 158 4820 rundll32.exe 159 4820 rundll32.exe 160 4820 rundll32.exe 161 4820 rundll32.exe 162 4820 rundll32.exe 163 4820 rundll32.exe 164 4820 rundll32.exe 165 4820 rundll32.exe 166 4820 rundll32.exe 167 4820 rundll32.exe -
resource yara_rule behavioral2/memory/4820-133-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/4820-134-0x0000000000400000-0x00000000004B1000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2032 wrote to memory of 4820 2032 rundll32.exe 81 PID 2032 wrote to memory of 4820 2032 rundll32.exe 81 PID 2032 wrote to memory of 4820 2032 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39af536b60754423adff4b3a6158138f8f9bfdaf68461e8e8ae790eb9512ee60.dll,#12⤵
- Blocklisted process makes network request
PID:4820
-