Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2023, 11:38
Static task
static1
Behavioral task
behavioral1
Sample
e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224.dll
Resource
win10v2004-20230915-en
General
-
Target
e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224.dll
-
Size
70KB
-
MD5
fa6bb9d7140acb30915bb34ed9311f47
-
SHA1
509ef04131897631b3c5c09883f80ce3473accb8
-
SHA256
e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224
-
SHA512
49124435064d04865ae118885a64047e644e2f6558353b7c45460ed2298e7a7fabe7319992442f5ee4a7a3be8bc4e73657a96d5412b6990e0141b20795fb7aa0
-
SSDEEP
1536:1eeJBxp1/+we0Ss1UsoILrAgI9uErsjkIyeaKbA5ebmz0R8rT4bk:jfT1/+wXWxILEuEUkIxRb4ebmwR8ru
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2924 wrote to memory of 4464 2924 rundll32.exe 83 PID 2924 wrote to memory of 4464 2924 rundll32.exe 83 PID 2924 wrote to memory of 4464 2924 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224.dll,#12⤵PID:4464
-