Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 01:22
Behavioral task
behavioral1
Sample
7a30cea87d8d28e60e7a1a75fc17657c8159f8f80ccfef34b094d8d42a380ae4.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a30cea87d8d28e60e7a1a75fc17657c8159f8f80ccfef34b094d8d42a380ae4.dll
Resource
win10v2004-20220812-en
General
-
Target
7a30cea87d8d28e60e7a1a75fc17657c8159f8f80ccfef34b094d8d42a380ae4.dll
-
Size
4KB
-
MD5
2361585f03a4aaacae107bca7153d590
-
SHA1
d0b2b5ca8db38cd2d6647e1262cfa7b16dc96b5a
-
SHA256
7a30cea87d8d28e60e7a1a75fc17657c8159f8f80ccfef34b094d8d42a380ae4
-
SHA512
053a7b1bacca4cef797deee5850ebd1fd42c3d906411e9aaec0b5bef457316583cecd8286849863490ac5e7a2900efa4c4013f7607681e94c685e26ec59d3d42
-
SSDEEP
48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LKsMYJx9NhJQNlg0YQWG5LUteIrMslf6y:TRphMzf8KEJxBJQNlg4W+L1IeDc0UVn
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/memory/2324-133-0x0000000075900000-0x0000000075908000-memory.dmp acprotect -
resource yara_rule behavioral2/memory/2324-133-0x0000000075900000-0x0000000075908000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2324 3000 rundll32.exe 81 PID 3000 wrote to memory of 2324 3000 rundll32.exe 81 PID 3000 wrote to memory of 2324 3000 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7a30cea87d8d28e60e7a1a75fc17657c8159f8f80ccfef34b094d8d42a380ae4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7a30cea87d8d28e60e7a1a75fc17657c8159f8f80ccfef34b094d8d42a380ae4.dll,#12⤵PID:2324
-