Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 23:55
Behavioral task
behavioral1
Sample
32602b83cb642cce4db9fdc68b8c101febda0b37ef2b36007cc30181297804d7.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
32602b83cb642cce4db9fdc68b8c101febda0b37ef2b36007cc30181297804d7.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
32602b83cb642cce4db9fdc68b8c101febda0b37ef2b36007cc30181297804d7.dll
-
Size
444KB
-
MD5
f6468579f2fb9b38f28e60f23bcef21d
-
SHA1
2306557eeb8cdc1d252dd9c97770f986f0ff080b
-
SHA256
32602b83cb642cce4db9fdc68b8c101febda0b37ef2b36007cc30181297804d7
-
SHA512
8f07b6fcfd12ce11ec16abd74c834bae8041b1b0f1eb6a5665e45c67e04ae30ebff9f6e8410ae2c81807f22b38bd913d5ebcea360a1fd9b0f6e986a1a6433cbc
-
SSDEEP
12288:+bPJ0HPviHSJuT4JqNtw8z98MdEtLcbdpZ7:+bh0vviHas4Jaw8z9rzbx
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 39 4224 rundll32.exe 40 4224 rundll32.exe 48 4224 rundll32.exe 50 4224 rundll32.exe 53 4224 rundll32.exe 54 4224 rundll32.exe 56 4224 rundll32.exe 57 4224 rundll32.exe 63 4224 rundll32.exe 64 4224 rundll32.exe 66 4224 rundll32.exe 67 4224 rundll32.exe 68 4224 rundll32.exe 69 4224 rundll32.exe 70 4224 rundll32.exe 71 4224 rundll32.exe 72 4224 rundll32.exe 73 4224 rundll32.exe 74 4224 rundll32.exe 75 4224 rundll32.exe 76 4224 rundll32.exe 77 4224 rundll32.exe 78 4224 rundll32.exe 79 4224 rundll32.exe 81 4224 rundll32.exe 84 4224 rundll32.exe 89 4224 rundll32.exe 91 4224 rundll32.exe 100 4224 rundll32.exe 101 4224 rundll32.exe 111 4224 rundll32.exe 113 4224 rundll32.exe 119 4224 rundll32.exe 120 4224 rundll32.exe 121 4224 rundll32.exe 122 4224 rundll32.exe 126 4224 rundll32.exe 131 4224 rundll32.exe 147 4224 rundll32.exe 150 4224 rundll32.exe 159 4224 rundll32.exe 160 4224 rundll32.exe 161 4224 rundll32.exe 162 4224 rundll32.exe 163 4224 rundll32.exe 164 4224 rundll32.exe 165 4224 rundll32.exe 166 4224 rundll32.exe 167 4224 rundll32.exe 168 4224 rundll32.exe 169 4224 rundll32.exe 170 4224 rundll32.exe 171 4224 rundll32.exe 172 4224 rundll32.exe 177 4224 rundll32.exe 178 4224 rundll32.exe 179 4224 rundll32.exe 180 4224 rundll32.exe 181 4224 rundll32.exe 182 4224 rundll32.exe 183 4224 rundll32.exe 184 4224 rundll32.exe 185 4224 rundll32.exe 186 4224 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4224 2516 rundll32.exe 86 PID 2516 wrote to memory of 4224 2516 rundll32.exe 86 PID 2516 wrote to memory of 4224 2516 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32602b83cb642cce4db9fdc68b8c101febda0b37ef2b36007cc30181297804d7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32602b83cb642cce4db9fdc68b8c101febda0b37ef2b36007cc30181297804d7.dll,#12⤵
- Blocklisted process makes network request
PID:4224
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
390KB
MD5c908c3acfeaa65cec4007887e397dc7a
SHA11f5ed375493aec09450e03d5fa8cc63d88960ee9
SHA256eb35595508554debbff3c303562930cfc220c4d8b146e7bd9eb17c7bfc9b2311
SHA512e5a0421275eff2fc8bd90c72ba23f2e7eabd70d4c31f3dd51d7ae14798e977644b0b9552a662df09fd0b4b05677a5e55913d78a67e8eba53e0ae6e61e2118e86