Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 08:23
Behavioral task
behavioral1
Sample
b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3.dll
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
General
-
Target
b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3.dll
-
Size
80KB
-
MD5
f95587b302a78ea56796a26d57a7f205
-
SHA1
3d13fd676fe2401d0d3376d775a39130b15c5883
-
SHA256
b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3
-
SHA512
71e709d4c7bc10d0b853af73e0a99a532d7a30f54c4801c0d1db66b223594adb901471c4bed46320fce0586c7affe792c890e5cdaa255ee177e52c6086c77506
-
SSDEEP
768:hmvT5hPKXIm//39QqUCaNadrsa2sI5ccdmGLkiGuWxZ:OH5m/P9xUCDdrV2s9QZ4xZ
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/2192-133-0x0000000010000000-0x0000000010014000-memory.dmp family_blackmoon behavioral2/memory/2192-134-0x0000000010000000-0x0000000010014000-memory.dmp family_blackmoon -
Blocklisted process makes network request 64 IoCs
flow pid Process 10 2192 rundll32.exe 12 2192 rundll32.exe 13 2192 rundll32.exe 14 2192 rundll32.exe 15 2192 rundll32.exe 16 2192 rundll32.exe 17 2192 rundll32.exe 18 2192 rundll32.exe 20 2192 rundll32.exe 21 2192 rundll32.exe 22 2192 rundll32.exe 24 2192 rundll32.exe 25 2192 rundll32.exe 26 2192 rundll32.exe 28 2192 rundll32.exe 30 2192 rundll32.exe 34 2192 rundll32.exe 35 2192 rundll32.exe 36 2192 rundll32.exe 37 2192 rundll32.exe 38 2192 rundll32.exe 40 2192 rundll32.exe 41 2192 rundll32.exe 42 2192 rundll32.exe 50 2192 rundll32.exe 53 2192 rundll32.exe 55 2192 rundll32.exe 56 2192 rundll32.exe 57 2192 rundll32.exe 58 2192 rundll32.exe 59 2192 rundll32.exe 60 2192 rundll32.exe 61 2192 rundll32.exe 62 2192 rundll32.exe 63 2192 rundll32.exe 64 2192 rundll32.exe 65 2192 rundll32.exe 69 2192 rundll32.exe 72 2192 rundll32.exe 75 2192 rundll32.exe 76 2192 rundll32.exe 80 2192 rundll32.exe 81 2192 rundll32.exe 82 2192 rundll32.exe 83 2192 rundll32.exe 84 2192 rundll32.exe 85 2192 rundll32.exe 87 2192 rundll32.exe 88 2192 rundll32.exe 89 2192 rundll32.exe 90 2192 rundll32.exe 93 2192 rundll32.exe 95 2192 rundll32.exe 96 2192 rundll32.exe 97 2192 rundll32.exe 98 2192 rundll32.exe 99 2192 rundll32.exe 100 2192 rundll32.exe 101 2192 rundll32.exe 102 2192 rundll32.exe 103 2192 rundll32.exe 104 2192 rundll32.exe 105 2192 rundll32.exe 106 2192 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2192 2188 rundll32.exe 79 PID 2188 wrote to memory of 2192 2188 rundll32.exe 79 PID 2188 wrote to memory of 2192 2188 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3.dll,#12⤵
- Blocklisted process makes network request
PID:2192
-