Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
171s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 23:57
Static task
static1
Behavioral task
behavioral1
Sample
6f32f13477645d70bde6b21d8c81b58081cdb21420ce8784d13a98a32c6fa78f.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6f32f13477645d70bde6b21d8c81b58081cdb21420ce8784d13a98a32c6fa78f.dll
Resource
win10v2004-20220812-en
General
-
Target
6f32f13477645d70bde6b21d8c81b58081cdb21420ce8784d13a98a32c6fa78f.dll
-
Size
6KB
-
MD5
6a0f55aacdd31218411832ab13e14c70
-
SHA1
ef4f033a53c36c08cf94fcbddc742dfb4740ef40
-
SHA256
6f32f13477645d70bde6b21d8c81b58081cdb21420ce8784d13a98a32c6fa78f
-
SHA512
16146f7b7322efb84217b10771b73f9946ff81b4b19396ba98decc6f5d7b2d8e0b34cae83aa4e89661ce9beed5370d4bc7f4d8a4bfa292c30facb3321d8c6eb1
-
SSDEEP
96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7pqkt+:juLJ/oAdQPQa2aeng7pB+
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4744 wrote to memory of 4512 4744 rundll32.exe 56 PID 4744 wrote to memory of 4512 4744 rundll32.exe 56 PID 4744 wrote to memory of 4512 4744 rundll32.exe 56
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f32f13477645d70bde6b21d8c81b58081cdb21420ce8784d13a98a32c6fa78f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f32f13477645d70bde6b21d8c81b58081cdb21420ce8784d13a98a32c6fa78f.dll,#12⤵PID:4512
-