Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll
Resource
win10v2004-20220812-en
General
-
Target
d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll
-
Size
368KB
-
MD5
434314e97ae563a7aec54a951652e098
-
SHA1
ae39b3530eb54bdecfd37e7e121c5bae6985d81b
-
SHA256
d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da
-
SHA512
8d5e76df67c956f58a66ae0070a758dc7300eecf5c03d9ef6848e2b1d4782a416411cb94b8c01f58c21ffcff3cf173ec3cc85df01bdd6865c3e7ba7301d3f990
-
SSDEEP
6144:oOdQNeWORa+vhOql8YY5wXRyl/AvVjN67OX9S2OuT250pPPdQhWFX4jVxiTQZ0ex:oOddWH+Zx8F5wXRuKjwUgCT2CAhWJSVP
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2092 wrote to memory of 4956 2092 rundll32.exe 79 PID 2092 wrote to memory of 4956 2092 rundll32.exe 79 PID 2092 wrote to memory of 4956 2092 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll,#12⤵PID:4956
-