Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 04:48
Behavioral task
behavioral1
Sample
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll
Resource
win10v2004-20230824-en
General
-
Target
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll
-
Size
51KB
-
MD5
a21fdd14fb1e00e0e9943b7d59be4842
-
SHA1
8b2453b41f1376a18a00884858352c6bfb93cab9
-
SHA256
901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8
-
SHA512
cb97f73893a66f006cc5235802dca691336a928445351b4c22130378c2a5a8a2a04075effc4757963c8d8e3756a2647e342ebfea86a9bc46f4f297255882590a
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLDJYH5:1dWubF3n9S91BF3fbonJYH5
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4240 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4248 wrote to memory of 4240 4248 rundll32.exe 85 PID 4248 wrote to memory of 4240 4248 rundll32.exe 85 PID 4248 wrote to memory of 4240 4248 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\901a54bd045a6bb667481209d569a4ba6c38f27367cc5b16f7dc7bb9d9ff40a8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4240
-