Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
ae74661ff096d04b2282bd6d5cc34b581e7db0888d98eb3d9918a1a6c6f39e1f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae74661ff096d04b2282bd6d5cc34b581e7db0888d98eb3d9918a1a6c6f39e1f.dll
Resource
win10v2004-20220901-en
General
-
Target
ae74661ff096d04b2282bd6d5cc34b581e7db0888d98eb3d9918a1a6c6f39e1f.dll
-
Size
47KB
-
MD5
4cf31390da813d559f7b628b9c2f9b2d
-
SHA1
7108d7235d337b8f6637a38c397ce8cfaea981b1
-
SHA256
ae74661ff096d04b2282bd6d5cc34b581e7db0888d98eb3d9918a1a6c6f39e1f
-
SHA512
1a7aae779465622d2fc958eb36900926e6e07957053d1ad2af24cbf6549e3eb4265d170e3503723810113fc219a81c1ef9eaf90adbe2b786fce37834342b0770
-
SSDEEP
768:drev2AeDcayKgD6CDJVxj+v9iHj01KJ63CxMCp0dQDCLKBLaTLIk386HVr7wIN:di2AeDu9D6Cl3SlFKJWCKCk3seTLI6fL
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vituwepa.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\mikereru rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4316 rundll32.exe 4316 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4880 wrote to memory of 4316 4880 rundll32.exe 82 PID 4880 wrote to memory of 4316 4880 rundll32.exe 82 PID 4880 wrote to memory of 4316 4880 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae74661ff096d04b2282bd6d5cc34b581e7db0888d98eb3d9918a1a6c6f39e1f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae74661ff096d04b2282bd6d5cc34b581e7db0888d98eb3d9918a1a6c6f39e1f.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4316
-