Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 04:50
Behavioral task
behavioral1
Sample
681829f54228f96eba60ecec070f6a13.dll
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
681829f54228f96eba60ecec070f6a13.dll
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
681829f54228f96eba60ecec070f6a13.dll
-
Size
44KB
-
MD5
681829f54228f96eba60ecec070f6a13
-
SHA1
e5d6b65ec4c34fb587b055526cda0b635d90e1f5
-
SHA256
4040003f1c2e98555506444cc8ac2d47c529fb3b119b649d70589557b7fea428
-
SHA512
7c4e1cf0e982e328646069af7ec20a0d3345764f3c4a9b22c55228910cbbce77cc18d63e428252934f33fca667d1fa937a03a529ae25a99560a3ce2a86b227ad
-
SSDEEP
768:xnOK+3JqS9V+dMCdSsAVlNmpB7w3PBGU+w73fCFxOqLMBH3fxa1Vu6dX4aGdnbcc:xnOHoSTtCd8Nmvs3PBGAva8qLMBHMFdk
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2460-0-0x0000000010000000-0x0000000010034000-memory.dmp upx behavioral2/memory/2460-2-0x0000000010000000-0x0000000010034000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\version1.dll rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2460 rundll32.exe 2460 rundll32.exe 2460 rundll32.exe 2460 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2460 2104 rundll32.exe 86 PID 2104 wrote to memory of 2460 2104 rundll32.exe 86 PID 2104 wrote to memory of 2460 2104 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\681829f54228f96eba60ecec070f6a13.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\681829f54228f96eba60ecec070f6a13.dll,#12⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2460
-