Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
a65b0d905b0b9185bb2c10685b9b8c5c6adef91e5bc9b67c2e8ca48586181ee6.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a65b0d905b0b9185bb2c10685b9b8c5c6adef91e5bc9b67c2e8ca48586181ee6.dll
Resource
win10v2004-20230915-en
General
-
Target
a65b0d905b0b9185bb2c10685b9b8c5c6adef91e5bc9b67c2e8ca48586181ee6.dll
-
Size
2.7MB
-
MD5
e32b5d582a1ab3e2c26694b1c4012919
-
SHA1
37a66b1061dcc206b18d5e13a56432e718d76467
-
SHA256
a65b0d905b0b9185bb2c10685b9b8c5c6adef91e5bc9b67c2e8ca48586181ee6
-
SHA512
d017818aba5fa8c221b93648ef670ac3a32a543a9b7382cedffe4f8fae1cb230a6cffb410d51aa56f174ca49a4f1839ba05792d6e9c4104503295efc91a61aab
-
SSDEEP
49152:Uh64pOn7hFOsd2/PEvx8QeGzKV34SP+mmtYZQsUBlCghXRb:M64I3ROPCHe+KJ46xsBlH
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2552 wrote to memory of 4012 2552 rundll32.exe 24 PID 2552 wrote to memory of 4012 2552 rundll32.exe 24 PID 2552 wrote to memory of 4012 2552 rundll32.exe 24
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a65b0d905b0b9185bb2c10685b9b8c5c6adef91e5bc9b67c2e8ca48586181ee6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a65b0d905b0b9185bb2c10685b9b8c5c6adef91e5bc9b67c2e8ca48586181ee6.dll,#12⤵PID:4012
-