Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
2235124d288096322127b0e49fe691bb210f399e64bbd7215dc10f42d9d79baf.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2235124d288096322127b0e49fe691bb210f399e64bbd7215dc10f42d9d79baf.dll
Resource
win10v2004-20231020-en
General
-
Target
2235124d288096322127b0e49fe691bb210f399e64bbd7215dc10f42d9d79baf.dll
-
Size
312KB
-
MD5
c85a6e3bc452cb0b5cd9391878d27e79
-
SHA1
42a7909a3ba4eb2547bec3bb38a0c72afe87131a
-
SHA256
2235124d288096322127b0e49fe691bb210f399e64bbd7215dc10f42d9d79baf
-
SHA512
66bd59e9b2abfa567f804b0a7feec74554e96043d6d2706963919ef7844980117bf3c13eef2038f63b2a19575bd9cb8616fe37bc08dbff243ce19e3df0742984
-
SSDEEP
3072:0hDyLuzPIyXjh0Vksf1lmqhZjY+rPW6VIXgV:0h+EA7XI
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 788 wrote to memory of 3988 788 rundll32.exe 82 PID 788 wrote to memory of 3988 788 rundll32.exe 82 PID 788 wrote to memory of 3988 788 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2235124d288096322127b0e49fe691bb210f399e64bbd7215dc10f42d9d79baf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2235124d288096322127b0e49fe691bb210f399e64bbd7215dc10f42d9d79baf.dll,#12⤵PID:3988
-