Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2023, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll
Resource
win10v2004-20230915-en
General
-
Target
4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll
-
Size
1.2MB
-
MD5
bf1d9c4ac5194bc875e58fb77e4eb8af
-
SHA1
074b8f758bfb6dfbb516d221684134e0f216b717
-
SHA256
4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086
-
SHA512
15262d8debd28e56f8d381f4c06f42a1a5cacabb67a55457cbbf6893755dfc72b49ca1125e0e2c49dd366b4b9d6272f3f9a50acc707ea956e9a7b9b039376fa7
-
SSDEEP
24576:TfBb1Ty8D7jIZRXK926gBfpo1rI/oyHR:TzTPjIZF9XBf2OAyHR
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3352 rundll32.exe 3352 rundll32.exe 3352 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 800 wrote to memory of 3352 800 rundll32.exe 85 PID 800 wrote to memory of 3352 800 rundll32.exe 85 PID 800 wrote to memory of 3352 800 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3352
-