Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10370e8b2e99072e6034de847a2d140a.dll
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
10370e8b2e99072e6034de847a2d140a.dll
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
10370e8b2e99072e6034de847a2d140a.dll
-
Size
864KB
-
MD5
10370e8b2e99072e6034de847a2d140a
-
SHA1
43b978eb590b0b0d687a87716993bc24f561d999
-
SHA256
03e541f4c32aa6628f22bb81879fa0318736949deedd9ed5a169cbec13fc1536
-
SHA512
7890b1890d0098f093a122fd0d6b63077799b9676623e6d18f5890d6869f3e1943e983a1b400c14cebb28325faa448a30e38436ae8be310801df7a0d60602174
-
SSDEEP
12288:bS9GlcXAwcHAS7sQis2Y/7+ztf7GjxotbDUEMr21lPdki:bS5AwcHAgs9s26Szt/bDUEMQPl
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1732 rundll32.exe 1732 rundll32.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 852 wrote to memory of 1732 852 rundll32.exe 16 PID 852 wrote to memory of 1732 852 rundll32.exe 16 PID 852 wrote to memory of 1732 852 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10370e8b2e99072e6034de847a2d140a.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1732
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10370e8b2e99072e6034de847a2d140a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:852