Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 19:56
Behavioral task
behavioral1
Sample
ca59bc5a9e1a979abeb7dac189519906a77720feb6561a5e96f8453d440d3364.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ca59bc5a9e1a979abeb7dac189519906a77720feb6561a5e96f8453d440d3364.dll
Resource
win10v2004-20220812-en
General
-
Target
ca59bc5a9e1a979abeb7dac189519906a77720feb6561a5e96f8453d440d3364.dll
-
Size
69KB
-
MD5
f9801c09ab0dfd31938a8df280b2b8b3
-
SHA1
cbe734f81b607b9ebef269bc23222ba175d4874d
-
SHA256
ca59bc5a9e1a979abeb7dac189519906a77720feb6561a5e96f8453d440d3364
-
SHA512
df56b8cef28b4788912a96b708d54150644a3397b1d738a6ca0a8d7793cd3dc70fa62369afcf7f25d04fdbd2974cb839d481d870b2bdfd7ba5d92de076e40d81
-
SSDEEP
1536:ob8Vwn/JZ16v/oD/fIzv9utuxZBGF4OWg2mG5n3TPIJrJ5O:oz/L16v/oDScEZBy4OWGG5nIrJ5O
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2688 wrote to memory of 1428 2688 rundll32.exe 79 PID 2688 wrote to memory of 1428 2688 rundll32.exe 79 PID 2688 wrote to memory of 1428 2688 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca59bc5a9e1a979abeb7dac189519906a77720feb6561a5e96f8453d440d3364.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca59bc5a9e1a979abeb7dac189519906a77720feb6561a5e96f8453d440d3364.dll,#12⤵PID:1428
-