Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 02:24
Static task
static1
Behavioral task
behavioral1
Sample
577c9c8d6c995fb3f4163e31ee7c7063226ce25ed5bb3747413127a41233dfee.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
577c9c8d6c995fb3f4163e31ee7c7063226ce25ed5bb3747413127a41233dfee.dll
Resource
win10v2004-20220812-en
General
-
Target
577c9c8d6c995fb3f4163e31ee7c7063226ce25ed5bb3747413127a41233dfee.dll
-
Size
8KB
-
MD5
310e894c01832a098543126ff557e480
-
SHA1
9a4d4fa6c8ed15e8f65ec864f3577ebbbb561db8
-
SHA256
577c9c8d6c995fb3f4163e31ee7c7063226ce25ed5bb3747413127a41233dfee
-
SHA512
1cbb8ac989ad1160482267ea7d1e7c3178e4d1287bc40869688429c88f78892cd888ab8758ffd93696b8e87d9110b4bb5b976b425b084c46969909f222ad2252
-
SSDEEP
96:FurYVbs15rZ+TMz6ZTHNu2a8+x9G3G1c/YFAWcD:F746TMz9BGF/YFAWcD
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 884 wrote to memory of 1560 884 rundll32.exe 80 PID 884 wrote to memory of 1560 884 rundll32.exe 80 PID 884 wrote to memory of 1560 884 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\577c9c8d6c995fb3f4163e31ee7c7063226ce25ed5bb3747413127a41233dfee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\577c9c8d6c995fb3f4163e31ee7c7063226ce25ed5bb3747413127a41233dfee.dll,#12⤵PID:1560
-