Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 01:50
Static task
static1
Behavioral task
behavioral1
Sample
c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll
Resource
win10v2004-20220812-en
General
-
Target
c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll
-
Size
33KB
-
MD5
6998b705ace78ebcf55c6729d310d99c
-
SHA1
90d1e9a4a7bc6a20c989d3822f4fb336077b7e1d
-
SHA256
c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954
-
SHA512
891e3143bead563a97cada0b0f008e45ade5e8c72b8f9a09412ed07a7442d05e172fbccc536caa49ef0d5301740dc8179fc926468581c3a1208aaef50148bc54
-
SSDEEP
768:G5C39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+X:G5wgAEw0kY87EWddgWk+Rd+X
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5072 wrote to memory of 2296 5072 rundll32.exe 76 PID 5072 wrote to memory of 2296 5072 rundll32.exe 76 PID 5072 wrote to memory of 2296 5072 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c04af5aefc5cd9a0e88d6af25f9535b10c35d589f890dd0375038bdf6a5f1954.dll,#12⤵PID:2296
-