Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 12:29
Behavioral task
behavioral1
Sample
8c145eb875f43b858165976bd3e556ab.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c145eb875f43b858165976bd3e556ab.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
8c145eb875f43b858165976bd3e556ab.dll
-
Size
747KB
-
MD5
8c145eb875f43b858165976bd3e556ab
-
SHA1
8fd95103999bbbc655f9781a73553798331c6594
-
SHA256
9e984b6cb5b8b48bb48b32db26ff7e4f7329aed6b813a3aae5b3a10b345d10ba
-
SHA512
6560071c99f9a2d1d4ff1a6520213b0898ba4e7f3805514efdc5c2d91765b4f504134e97c6a8877c665898a11423b2ccd233dde6a3087f5f9b4c5460ae5b17a2
-
SSDEEP
12288:irTmzUHgoZ4wcY6mN9ELoGd/VVz7V8KEpKIeyqEJtK8UeJixjFNehis3bKy:sIUH0wx6mN9ELH/TF8K2KBydJgPxQ+y
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1168-0-0x00000000023D0000-0x0000000002589000-memory.dmp vmprotect behavioral2/memory/1168-2-0x00000000023D0000-0x0000000002589000-memory.dmp vmprotect behavioral2/memory/1168-1-0x00000000023D0000-0x0000000002589000-memory.dmp vmprotect behavioral2/memory/1168-3-0x00000000023D0000-0x0000000002589000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3864 wrote to memory of 1168 3864 rundll32.exe 14 PID 3864 wrote to memory of 1168 3864 rundll32.exe 14 PID 3864 wrote to memory of 1168 3864 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#11⤵PID:1168
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c145eb875f43b858165976bd3e556ab.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3864