Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 22:38
Behavioral task
behavioral1
Sample
9d03b3f661077004989b442e99d375e1baf277c22032925eabe047036300187c.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9d03b3f661077004989b442e99d375e1baf277c22032925eabe047036300187c.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
9d03b3f661077004989b442e99d375e1baf277c22032925eabe047036300187c.dll
-
Size
3KB
-
MD5
db0231be5c00fb12d5c11b482b5caee0
-
SHA1
ca0dd767b4a805990284a2091e076970aee36f92
-
SHA256
9d03b3f661077004989b442e99d375e1baf277c22032925eabe047036300187c
-
SHA512
ac2b2970a8e819f03ba072636eaee1fe49273ea336ec7d034783055176417aecb4fda8acfdc0b67649d3fc29e79267c9e866f1d96fef5ca4b38100a3b4dfebf3
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1672 wrote to memory of 3580 1672 rundll32.exe 80 PID 1672 wrote to memory of 3580 1672 rundll32.exe 80 PID 1672 wrote to memory of 3580 1672 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d03b3f661077004989b442e99d375e1baf277c22032925eabe047036300187c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d03b3f661077004989b442e99d375e1baf277c22032925eabe047036300187c.dll,#12⤵PID:3580
-