Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
Resource
win10v2004-20230703-en
General
-
Target
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
-
Size
213KB
-
MD5
fba481774812fa3c6424bece81f4923d
-
SHA1
cd93cc0fc436dd9cffda641f62edfd9409c3066d
-
SHA256
861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e
-
SHA512
e7c5a659d3e15e53a3247c90175d4c7a8dacffd34a551c090b9c8478f2b9883cde9790e181b7f4cc74a8ce767537111c4cf279a8e0a9ffb9332a44c2aeece9b4
-
SSDEEP
1536:N8ZkXEMm6jh/3XNPpdpytxr5QSM9JaIbRZmFcPgHrme:PEA3XNItTQSM9JaIbRZmFcPle
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3344 wrote to memory of 3880 3344 rundll32.exe 83 PID 3344 wrote to memory of 3880 3344 rundll32.exe 83 PID 3344 wrote to memory of 3880 3344 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#12⤵PID:3880
-