Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
ca487080a3bd9998a14a3c904f5a7773107b455bf41fc9802c185c82b72409d9.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ca487080a3bd9998a14a3c904f5a7773107b455bf41fc9802c185c82b72409d9.dll
Resource
win10v2004-20220812-en
General
-
Target
ca487080a3bd9998a14a3c904f5a7773107b455bf41fc9802c185c82b72409d9.dll
-
Size
22KB
-
MD5
37358f86485bf5b832fb5d12e994c78a
-
SHA1
fecee1f5c72f94d374fc66cdf3233ce61206ca5a
-
SHA256
ca487080a3bd9998a14a3c904f5a7773107b455bf41fc9802c185c82b72409d9
-
SHA512
5f71c80d12b49251dc01a08a21a2634a81f7dc8fef5e814fd9318abf407f15825309d28c61fd68823d14148ab798e4049fce7c161dbb4ff9de746fc202816f33
-
SSDEEP
384:vGdWzyj1Hj75GMEqwD0mWoddhq1xoMfNDsCaacY8aC2jDgHWkCTQiTOlf95Vfs1:edcClPMMtwD0mWUh8D9hcY8a3IHW3Tgy
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 536 wrote to memory of 2360 536 rundll32.exe 79 PID 536 wrote to memory of 2360 536 rundll32.exe 79 PID 536 wrote to memory of 2360 536 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca487080a3bd9998a14a3c904f5a7773107b455bf41fc9802c185c82b72409d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca487080a3bd9998a14a3c904f5a7773107b455bf41fc9802c185c82b72409d9.dll,#12⤵PID:2360
-