Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
3536598af43a43b708e06c45b2f055915b834a30a11f52d09913b6a53c3b93cb.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3536598af43a43b708e06c45b2f055915b834a30a11f52d09913b6a53c3b93cb.dll
Resource
win10v2004-20221111-en
General
-
Target
3536598af43a43b708e06c45b2f055915b834a30a11f52d09913b6a53c3b93cb.dll
-
Size
101KB
-
MD5
0b7e6eba53d5cf47bcc5f5dbfdbd6130
-
SHA1
2d5f63b1f390c070aa0278aee4f0a46c8dd83c03
-
SHA256
3536598af43a43b708e06c45b2f055915b834a30a11f52d09913b6a53c3b93cb
-
SHA512
c01861d5a2b14914d4555d32e8908e5a876ce0c6c0fe7fe79252c335093a158faba31caa74192aaddafd5fa0914a1199861cf5504fe3b64525d0c9b01b2d8be2
-
SSDEEP
1536:ldIOL2smex6AAje771ExQeC+P8fsl8olebWV6rHAFypJnjgcagpzRKatwd40XwcX:AOL2smbjZxLL8UaCV68FyXnkrOltkng8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4456 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 212 wrote to memory of 4456 212 rundll32.exe 83 PID 212 wrote to memory of 4456 212 rundll32.exe 83 PID 212 wrote to memory of 4456 212 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3536598af43a43b708e06c45b2f055915b834a30a11f52d09913b6a53c3b93cb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3536598af43a43b708e06c45b2f055915b834a30a11f52d09913b6a53c3b93cb.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4456
-