Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.25010e70d4e92a78413657838612e100.dll
Resource
win7-20230831-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.25010e70d4e92a78413657838612e100.dll
Resource
win10v2004-20231020-en
1 signatures
150 seconds
General
-
Target
NEAS.25010e70d4e92a78413657838612e100.dll
-
Size
150KB
-
MD5
25010e70d4e92a78413657838612e100
-
SHA1
e7999b5684408a709ddc978aee15ebb66de21839
-
SHA256
3fcd0372503c8dc2baefa6f7f9b33567fb62d58ffc4f2cbbe19b7b5885bf613b
-
SHA512
add91542729a8575aa253f25016ed0343c5672fa6a2ebbd338f62a188ac4d5e9f5d157de6831de2ccba752d97a8c5b0c90f3a8c3f3f35804eb2dc1276194999d
-
SSDEEP
3072:b/2jRbSsWqrWOwYCmotyihpD0BI6XBJficD3wU:U1fBihpDmfIU
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3840 4864 rundll32.exe 84 PID 4864 wrote to memory of 3840 4864 rundll32.exe 84 PID 4864 wrote to memory of 3840 4864 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25010e70d4e92a78413657838612e100.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25010e70d4e92a78413657838612e100.dll,#12⤵PID:3840
-