Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
257s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
21/09/2023, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll
Resource
win10-20230915-en
General
-
Target
e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll
-
Size
1.4MB
-
MD5
64e04aa44766d3a1edf8362bbaba0a1c
-
SHA1
2605422b1bb3ddfa67e5c82229627aa06d2cd926
-
SHA256
e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa
-
SHA512
14a6dfee7bbb9dc566db3c5b35f022054947a6ff23a43451a71efaa43cc5411d68492455d4a359d1c22f44a23366584399f7fa843d82958b8477ae1c17638829
-
SSDEEP
24576:fJmyeKfuSBsRsq0iuSNDMRPnMyJ8q6NXBoJu5ubUrl3z9n+IUYgkVRDufwzHn9u:fVpj6RhhLMRvMyJW/u6thUkfFB
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3120 5048 rundll32.exe 69 PID 5048 wrote to memory of 3120 5048 rundll32.exe 69 PID 5048 wrote to memory of 3120 5048 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll,#12⤵PID:3120
-