Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 01:03 UTC
Static task
static1
Behavioral task
behavioral1
Sample
fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll
Resource
win10v2004-20230703-en
General
-
Target
fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll
-
Size
1.5MB
-
MD5
568b30c866e266183da4fb961cf230c2
-
SHA1
cd5870e83e1c1e16a46d3429d7077db19e3e6cbc
-
SHA256
fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2
-
SHA512
ee5456226e6a4df00f1207b77daeda80b42e9d656ddf301787f9b4e27d916471669caa346aa773fef9c96571de7d2a34ac2b426e8f4931a55ea5d24278302734
-
SSDEEP
24576:GvrIaujE5ae2tKBmW5CqY5xs2D58GALbwk+E8Fcc:GG5qj2D5Me
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2860-14-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-15-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-13-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-17-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-22-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-20-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-24-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-26-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-28-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-30-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-32-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-34-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-36-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-38-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-40-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-42-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-44-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-46-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-48-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-50-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-52-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-54-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-56-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx behavioral2/memory/2860-57-0x0000000002CB0000-0x0000000002CEE000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2860 rundll32.exe 2860 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4604 wrote to memory of 2860 4604 rundll32.exe 81 PID 4604 wrote to memory of 2860 4604 rundll32.exe 81 PID 4604 wrote to memory of 2860 4604 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2860
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request254.3.248.8.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.73.50.20.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
158.240.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
59.128.231.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.136.104.51.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
70 B 124 B 1 1
DNS Request
254.3.248.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
69 B 155 B 1 1
DNS Request
9.73.50.20.in-addr.arpa