Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0de7e3a01be48fbaf43502c43fbadee5.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0de7e3a01be48fbaf43502c43fbadee5.dll
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
0de7e3a01be48fbaf43502c43fbadee5.dll
-
Size
24KB
-
MD5
0de7e3a01be48fbaf43502c43fbadee5
-
SHA1
bb2320e42c0b45c8664b87fa5ab0af72e79d4a01
-
SHA256
e49930f989d56d57785ee2df0ce9a4b2fd0c04a668b307b3422cc4c5b279787c
-
SHA512
3d7e2d9a74caa8eab69114c85f5cebfb0384e7d974838892149bea0ac6dbce8c63542e4cb5fd3ea3f217291736925a5787c8075f2475e55a559d37fad2d4d75f
-
SSDEEP
768:gDT3ucpRiGSFvTBBHDUvUzMOKs/owgy5+j+35Ht:QLucZSF7BBHDU8zMOKWowgy5+jgt
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 348 wrote to memory of 1316 348 rundll32.exe 62 PID 348 wrote to memory of 1316 348 rundll32.exe 62 PID 348 wrote to memory of 1316 348 rundll32.exe 62
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0de7e3a01be48fbaf43502c43fbadee5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0de7e3a01be48fbaf43502c43fbadee5.dll,#12⤵PID:1316
-