Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
0eaa508dfa03cb7ebe431eac50666fb68a59841a0624c3a63ad16e3a20cd5484.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0eaa508dfa03cb7ebe431eac50666fb68a59841a0624c3a63ad16e3a20cd5484.dll
Resource
win10v2004-20220901-en
General
-
Target
0eaa508dfa03cb7ebe431eac50666fb68a59841a0624c3a63ad16e3a20cd5484.dll
-
Size
183KB
-
MD5
10c9650a65bc2911f1542f3af649f4b8
-
SHA1
72a13277f2e5e7d4de7ecc9a942b56620c801131
-
SHA256
0eaa508dfa03cb7ebe431eac50666fb68a59841a0624c3a63ad16e3a20cd5484
-
SHA512
e6b695994e041f9386ef957484efb1d13e17b758d302cc096f34863e9cf03ac4d30c0abb08b85fa36355ef027c2ad5ad6461efe44316bb65b5b8a65efe1362cd
-
SSDEEP
3072:PdJQi+hKNmdnTbz8RXocUz3VrPl+sXWYD8YUol/IQFVkXUT5iHsEtCMuuraDQvAq:PkTKNmdL8RXYDVLWI8YhiQjkXUTosnYD
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\4845dc02a3e61da36a3c4260a14895a86bf66605cae134ebe7bc30afd805aae0.pad rundll32.exe File opened for modification C:\PROGRA~3\4845dc02a3e61da36a3c4260a14895a86bf66605cae134ebe7bc30afd805aae0.pad rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 960 wrote to memory of 4572 960 rundll32.exe 76 PID 960 wrote to memory of 4572 960 rundll32.exe 76 PID 960 wrote to memory of 4572 960 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0eaa508dfa03cb7ebe431eac50666fb68a59841a0624c3a63ad16e3a20cd5484.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0eaa508dfa03cb7ebe431eac50666fb68a59841a0624c3a63ad16e3a20cd5484.dll,#12⤵
- Drops file in Program Files directory
PID:4572
-