Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
184s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll
Resource
win10v2004-20221111-en
General
-
Target
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll
-
Size
65KB
-
MD5
4322068e5b6f6d9080fa5bd602131130
-
SHA1
9fd3163089d1c9621d54792e0bf1cdd1dbf17043
-
SHA256
3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d
-
SHA512
a15249313a7a9c06a419923c0830c45dd175769e5d885badabeea67b0855ce102319f2ebc11ca8724ac6cb9452f894dd076b832044ef9fea1ce2be8f6c0a0596
-
SSDEEP
1536:BjHaZJABplBaMWgd863SzTWTtZalE9LpJQm8l1:Bj6TAHBZ863SzTWLdVQm8l1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2704 wrote to memory of 3696 2704 rundll32.exe 82 PID 2704 wrote to memory of 3696 2704 rundll32.exe 82 PID 2704 wrote to memory of 3696 2704 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f8099af3bac786754ce815ba37ec3a1e7739d9fcd2741e1466eb0f68885b73d.dll,#12⤵PID:3696
-