Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll
Resource
win10v2004-20230824-en
General
-
Target
a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll
-
Size
3.6MB
-
MD5
a285d236f4bc221cae4f07407c6c4bb4
-
SHA1
7f85a28da3d659443e56892b5325eedc2702fabd
-
SHA256
a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a
-
SHA512
e4e3fdd3efb710a9a18c74f2329f5e75faf9a9483bad0c35999dcee952c5c532c15b66a5d2956d63753ee7770448323b42934a9b1dd1f48f0e289816ec375d53
-
SSDEEP
49152:tzzvNtsvz12Acn9CkZ0X2hff/yC3G/j111Y111D111CRB6+zINs4:pzjo1yrpR3f8111Y111D111k6+zINx
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WindowSystemNewUpdate44.log rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3940 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1376 wrote to memory of 3940 1376 rundll32.exe 84 PID 1376 wrote to memory of 3940 1376 rundll32.exe 84 PID 1376 wrote to memory of 3940 1376 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3940
-