Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2023, 09:06
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll
-
Size
1004KB
-
MD5
03b3f0bbd33ad1e4801cfb208cf247a0
-
SHA1
49e6a8c3c568392c9bd2bf525fc937db93d768f4
-
SHA256
f4689bcbeb1461807126be2a63ef1640ecc2ed2ce415bfe4c5fe52b952c5d506
-
SHA512
5bb0534bd5dd9a95ba4896cc9817fc3aa84811139b4aa13b4b254abec682b29a001868ead7ee9fd73c1c06fafb101553df130fdb6dcbb51040b16041c11181ad
-
SSDEEP
12288:yjbmFHFtNPJBdPoW+/pmBny5GQBKYPmB+t7ghDyxFLgHMOvU20:yjbmFXNfdgX/p6PSKrBxy0HM+70
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 852 wrote to memory of 1800 852 rundll32.exe 88 PID 852 wrote to memory of 1800 852 rundll32.exe 88 PID 852 wrote to memory of 1800 852 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll,#12⤵PID:1800
-