Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 23:28
Behavioral task
behavioral1
Sample
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll
Resource
win10v2004-20231215-en
General
-
Target
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll
-
Size
899KB
-
MD5
90688437fa72a2dfe9488a39b2ed7c1d
-
SHA1
91fe6143a29c1cdf1c8be73c4a6bbeb123fe6501
-
SHA256
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76
-
SHA512
43a737caa80097cf4127f467222dd47f104b4c813833ac0b279b74140f9d0ffe143376518350c66bd3d482f375383b88d2037e341413db41d6b3e1a28b41c5da
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXC:7wqd87VC
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 812 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4604 wrote to memory of 812 4604 rundll32.exe 90 PID 4604 wrote to memory of 812 4604 rundll32.exe 90 PID 4604 wrote to memory of 812 4604 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:812
-