Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 13:23
Static task
static1
Behavioral task
behavioral1
Sample
ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
Resource
win10v2004-20220901-en
General
-
Target
ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
-
Size
196KB
-
MD5
62b0a37ed6dc8ea1ed607c384f8dbabb
-
SHA1
48b300b448f43572e1bbbca44aa98bb210fb6aa1
-
SHA256
ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e
-
SHA512
111c8958b2d2f16040c810eabf238dceb172e753054b1966000cbac6fb3afeb83d5d55239ee36ccbbe9673b9a9a2e83a002f513946caae66f087411788c37843
-
SSDEEP
6144:jYJ4S0Qmn675xHu5nsMJqS/Mmc0TkkRsknTVD:G4S0Qmn675xHu5C+M075R
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4996 wrote to memory of 3464 4996 regsvr32.exe 81 PID 4996 wrote to memory of 3464 4996 regsvr32.exe 81 PID 4996 wrote to memory of 3464 4996 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll2⤵PID:3464
-