Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
13ac18e9d3d25d5515e257abe11bed38326c924c202455b6b2e10c42343a63d0.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
13ac18e9d3d25d5515e257abe11bed38326c924c202455b6b2e10c42343a63d0.dll
Resource
win10v2004-20230915-en
General
-
Target
13ac18e9d3d25d5515e257abe11bed38326c924c202455b6b2e10c42343a63d0.dll
-
Size
13.7MB
-
MD5
e1d045f01163785b3cc5f290e257adbe
-
SHA1
5496f73d664974d90bd20f4ff23e85e2dd05cd93
-
SHA256
13ac18e9d3d25d5515e257abe11bed38326c924c202455b6b2e10c42343a63d0
-
SHA512
737e7610a9199ac920b565dd31d5cf4d9eacfc4905079d1834414b4e226a9fd61888fc335f81c614b264fa966be783c581bef31362f7972cfeb72ba809f5cc2b
-
SSDEEP
196608:/v4LMOiaA2mSLU9rPKFyJEO8acTs3u35za4uPyr6pgAV0G6KF+DP36aEjHo3Zn:X4LtkV3EO8acTZzanPqCEGPQ63I3Z
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 428 rundll32.exe 428 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 428 rundll32.exe 428 rundll32.exe 428 rundll32.exe 428 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 428 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4908 wrote to memory of 428 4908 rundll32.exe 85 PID 4908 wrote to memory of 428 4908 rundll32.exe 85 PID 4908 wrote to memory of 428 4908 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13ac18e9d3d25d5515e257abe11bed38326c924c202455b6b2e10c42343a63d0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13ac18e9d3d25d5515e257abe11bed38326c924c202455b6b2e10c42343a63d0.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:428
-