Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 14:32
Behavioral task
behavioral1
Sample
db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b.dll
Resource
win7-20221111-en
1 signatures
150 seconds
General
-
Target
db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b.dll
-
Size
95KB
-
MD5
21d7e446348def747c41365b3d86ef3b
-
SHA1
4e3936142277e078841f31aee1b1445e47b8e964
-
SHA256
db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b
-
SHA512
877c7f94a525daa4af029d82c37c40319db1370c7a7b92bcd1857c2ee05968d0ce559a37957d0b6bbccc91fc803af45ae56379f7dd0e8c42cfaa687ac058bee2
-
SSDEEP
1536:/YGGGBDexeOrAN0zor/uYaiwxcJ11fnwq0KTw+2Z0gNZTfY:/TGEAkNxuY3wxm1tnwqDTw+2Z0gNZTfY
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1212-133-0x0000000010000000-0x000000001001B000-memory.dmp family_gh0strat -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4860 wrote to memory of 1212 4860 rundll32.exe 79 PID 4860 wrote to memory of 1212 4860 rundll32.exe 79 PID 4860 wrote to memory of 1212 4860 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b.dll,#12⤵PID:1212
-