Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 02:05
Static task
static1
Behavioral task
behavioral1
Sample
b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll
Resource
win10v2004-20220812-en
General
-
Target
b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll
-
Size
33KB
-
MD5
3cad5bdfbe611b559932ccc91c12f1bb
-
SHA1
f7a4bfef88b5baa26863e5fd942188101aa039a8
-
SHA256
b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c
-
SHA512
5e6f1e33556e0c0267811d2747df44cbc1cf8161e2e32864f7c22d9c1ad04e9fa59b3562193634c46d2dc10358f2d959661fcdabb71731765a4f0f15bbae2a73
-
SSDEEP
768:0X5wlHbBOm1e6Y31CLlr7yV7/1GVF5lhCDmERaAG:m5QNOm16FChS7/1GVFL8aERHG
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2512 wrote to memory of 400 2512 rundll32.exe 79 PID 2512 wrote to memory of 400 2512 rundll32.exe 79 PID 2512 wrote to memory of 400 2512 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll,#12⤵PID:400
-