Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll
Resource
win10v2004-20220812-en
General
-
Target
6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll
-
Size
32KB
-
MD5
5f6f1b3ad9c5c2d87ec153aa8d911ce0
-
SHA1
8fd4e27402204e10cdb2882dbb370719e796255d
-
SHA256
6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd
-
SHA512
76321de117e60e657540844a797472ac8491671e145726378cb3284f165cb61385b3bcc467b9f1f15829735c58630f2ed75fd4ba45f1f1b67cce62ada30969ec
-
SSDEEP
384:xUIsK3EA9NMG5YBPUi9MY9zoDpb77+/VZSXGQG9aFJFrWCRIFCc3:xsKUTeos4MY9zqb7QZkGZ96BTRIQc3
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4076 wrote to memory of 2180 4076 rundll32.exe 81 PID 4076 wrote to memory of 2180 4076 rundll32.exe 81 PID 4076 wrote to memory of 2180 4076 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll,#12⤵PID:2180
-