Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 11:50
Behavioral task
behavioral1
Sample
970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll
Resource
win10v2004-20220812-en
General
-
Target
970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll
-
Size
140KB
-
MD5
d457ebfcf39f9129f2c884f19806bdb0
-
SHA1
5db371217ebf866f8eb415cb0620fbb634463bcb
-
SHA256
970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8
-
SHA512
54668cc8e725a8a3022f57ba6ce32d4f74c929d3c2860cbabb99335ebcd803adbd8b18bd84e020ad4ca09c9c06b28adee5b412b8be3802aff33505ff9136d4f7
-
SSDEEP
3072:Hb4s/l8iiDXiYukRy9Vd746gh4Z91gCBzTz4y3/UHj7Nzspl+fXF:HB/l0Xi3uyJ7Mhy9dx3s3f1
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1548-133-0x0000000075200000-0x0000000075247000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1548 1520 rundll32.exe 79 PID 1520 wrote to memory of 1548 1520 rundll32.exe 79 PID 1520 wrote to memory of 1548 1520 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll,#12⤵PID:1548
-