Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
171s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll
Resource
win10v2004-20221111-en
General
-
Target
a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll
-
Size
120KB
-
MD5
639e85c0fb705c57a1701b4db6d831e0
-
SHA1
d9b56de6a37d207a6af2a51256b91e770ab33729
-
SHA256
a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9
-
SHA512
7b772ece6294964ef2b778a9b2fe5f6a19d1f5ce5c0dc31d0c312350cf9b957ddba2ed571ccb9c144f228fd5847a4670d95868a3a2a49b6db7ec91a00e5fbe40
-
SSDEEP
768:TdYZgFNCFD/XfScRlRJ7Dir/dOlBwK7iAlp3xix78ivYvaAy6kPC:54gPGWczjPOOlBw+lpBX1d
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3428 wrote to memory of 1084 3428 rundll32.exe 83 PID 3428 wrote to memory of 1084 3428 rundll32.exe 83 PID 3428 wrote to memory of 1084 3428 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll,#12⤵PID:1084
-