Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2023, 06:52
Behavioral task
behavioral1
Sample
8765597e2b2ad59278f79004c74a3d809389406150bd7a5b715e80c8a8123331.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8765597e2b2ad59278f79004c74a3d809389406150bd7a5b715e80c8a8123331.dll
Resource
win10v2004-20230831-en
General
-
Target
8765597e2b2ad59278f79004c74a3d809389406150bd7a5b715e80c8a8123331.dll
-
Size
50KB
-
MD5
25ec6f01b331ac6f1779e66c66532e6a
-
SHA1
9da21447fb858b65ccb890e22ac4329455b652b6
-
SHA256
8765597e2b2ad59278f79004c74a3d809389406150bd7a5b715e80c8a8123331
-
SHA512
6d84c9cc85594b85ed5450656b0512e2d362b9cf4572fd08b0c951df2285991c5d6a4de40affed98974452db521ab41182256f6464cdebbc759dd459a83821b1
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5bJYH:W5ReWjTrW9rNPgYolJYH
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2604 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 116 wrote to memory of 2604 116 rundll32.exe 81 PID 116 wrote to memory of 2604 116 rundll32.exe 81 PID 116 wrote to memory of 2604 116 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8765597e2b2ad59278f79004c74a3d809389406150bd7a5b715e80c8a8123331.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8765597e2b2ad59278f79004c74a3d809389406150bd7a5b715e80c8a8123331.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2604
-