Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
b357e39b09e6cf007b4543c99a66c4dc032dd85d9a700b8cfe0d32ab77c84d5d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b357e39b09e6cf007b4543c99a66c4dc032dd85d9a700b8cfe0d32ab77c84d5d.dll
Resource
win10v2004-20221111-en
General
-
Target
b357e39b09e6cf007b4543c99a66c4dc032dd85d9a700b8cfe0d32ab77c84d5d.dll
-
Size
172KB
-
MD5
670713209a6fa4f212369f468218ed6d
-
SHA1
1b3e8164d1f38d28453e484f4454684d6bedc0f6
-
SHA256
b357e39b09e6cf007b4543c99a66c4dc032dd85d9a700b8cfe0d32ab77c84d5d
-
SHA512
beb11df9bcf50f540eb90a14c40d92d08baddde962385ebefa362302ee8856505ce61981b0a341463dc2922cbbe4075218f3c3802dd77eda976d2776dcf560ad
-
SSDEEP
3072:Wiu+GZlqkvHTQBdt9dkk5TwjeEl9coQ6qBs0FE5C8:Wt+GPqkHT2dt9dkk5UblW56qBJd8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2580 1304 rundll32.exe 83 PID 1304 wrote to memory of 2580 1304 rundll32.exe 83 PID 1304 wrote to memory of 2580 1304 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b357e39b09e6cf007b4543c99a66c4dc032dd85d9a700b8cfe0d32ab77c84d5d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b357e39b09e6cf007b4543c99a66c4dc032dd85d9a700b8cfe0d32ab77c84d5d.dll,#12⤵PID:2580
-