Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 22:15
Behavioral task
behavioral1
Sample
02db8197f9c392107c69e63e39e686c7fb26c0ac65bdd34a659aa98836778100.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
02db8197f9c392107c69e63e39e686c7fb26c0ac65bdd34a659aa98836778100.dll
Resource
win10v2004-20230915-en
General
-
Target
02db8197f9c392107c69e63e39e686c7fb26c0ac65bdd34a659aa98836778100.dll
-
Size
51KB
-
MD5
6181e0aea1d507abd435bb162bf76176
-
SHA1
d408b52fadf5e017b02d55797c7ba266eb6689b2
-
SHA256
02db8197f9c392107c69e63e39e686c7fb26c0ac65bdd34a659aa98836778100
-
SHA512
d75ed5693471b9292b59cbf31dec09cd996abc06c978d52fd8c55d9c2dea9212182d7f850426c9caa7d08a25c6381a7e3d00055408d2cc29703efdc7c5ffa781
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboxJYH5
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4696 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4696 3948 rundll32.exe 81 PID 3948 wrote to memory of 4696 3948 rundll32.exe 81 PID 3948 wrote to memory of 4696 3948 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02db8197f9c392107c69e63e39e686c7fb26c0ac65bdd34a659aa98836778100.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02db8197f9c392107c69e63e39e686c7fb26c0ac65bdd34a659aa98836778100.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4696
-