Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 13:25
Static task
static1
Behavioral task
behavioral1
Sample
c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll
Resource
win10v2004-20221111-en
General
-
Target
c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll
-
Size
110KB
-
MD5
c6a4ba42bdda16117ea1098e01c5147b
-
SHA1
7d122562bfe6c4656d124f681a0d50d100f5404d
-
SHA256
c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63
-
SHA512
1ea982859bf63702c7db0c17cfa787d74bcd7041eb2855e237f1116e72011f809695334c99aa7fbcad9acf2f9de9d8ba53213528abd83bb369fe14efc7cb1ccb
-
SSDEEP
1536:XIXbIMIqkuvfZ/AuwTVxsKDjirfmWHfqeyqkaUiqvic8fO89:X0fxxvfGTVaCkiqRue
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2932 wrote to memory of 208 2932 rundll32.exe 81 PID 2932 wrote to memory of 208 2932 rundll32.exe 81 PID 2932 wrote to memory of 208 2932 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll,#12⤵PID:208
-