Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 06:05
Static task
static1
Behavioral task
behavioral1
Sample
a080896ef90822e6887b5b3f2bdb05d291524603f14c5b95b67435c4447f0295.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a080896ef90822e6887b5b3f2bdb05d291524603f14c5b95b67435c4447f0295.dll
Resource
win10v2004-20220812-en
General
-
Target
a080896ef90822e6887b5b3f2bdb05d291524603f14c5b95b67435c4447f0295.dll
-
Size
1.2MB
-
MD5
58a866369ea8c7713e2c4622575ec842
-
SHA1
2e53fa46d0c3d874eebc7b4c4e5817c37fbba8a7
-
SHA256
a080896ef90822e6887b5b3f2bdb05d291524603f14c5b95b67435c4447f0295
-
SHA512
d1fce50a4cc3ee0438634399bce1ae3b373cad47988010d4aa77ca9f61239dec37483a1eda76a7560977a2652afba6ba9c84c7d24933b6222564abb56ff3463d
-
SSDEEP
12288:Jo/WsoV0zGgndnBnTw9zjMRSh5GqPtt9q17rOEKE:eRRzGgdhU+QOGtt9q1O0
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2736 wrote to memory of 1556 2736 rundll32.exe 79 PID 2736 wrote to memory of 1556 2736 rundll32.exe 79 PID 2736 wrote to memory of 1556 2736 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a080896ef90822e6887b5b3f2bdb05d291524603f14c5b95b67435c4447f0295.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a080896ef90822e6887b5b3f2bdb05d291524603f14c5b95b67435c4447f0295.dll,#12⤵PID:1556
-