Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
769403769d489788d28a1bb5168fe615ee79ad777d304085688563471a6d954a.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
769403769d489788d28a1bb5168fe615ee79ad777d304085688563471a6d954a.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
769403769d489788d28a1bb5168fe615ee79ad777d304085688563471a6d954a.dll
-
Size
7KB
-
MD5
58eb9ea7ad0a8a353c5890a67483375b
-
SHA1
1606aaed8965b3a8ce552f1e440e7d3ecd20d6ca
-
SHA256
769403769d489788d28a1bb5168fe615ee79ad777d304085688563471a6d954a
-
SHA512
c8d292af634540248b63852489377a072238b05b19d5353b65146dd6e8bbf75af64f59d6f6c0a7a4e6069d19dd38964f72b8159d9abb23e95477ccccba9646fe
-
SSDEEP
48:C2mX7scYnKFVhEjHu4mDvhxdJxN/m7DVRB5ps9L2I1IZWM4as5WwG2s4:uWkQuHhxzxUZ61EWzawWwG3
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe 3160 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5072 wrote to memory of 3160 5072 rundll32.exe 80 PID 5072 wrote to memory of 3160 5072 rundll32.exe 80 PID 5072 wrote to memory of 3160 5072 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\769403769d489788d28a1bb5168fe615ee79ad777d304085688563471a6d954a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\769403769d489788d28a1bb5168fe615ee79ad777d304085688563471a6d954a.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160
-