Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 06:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b0d852d2befda9d839342949b2f1423.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b0d852d2befda9d839342949b2f1423.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
0b0d852d2befda9d839342949b2f1423.dll
-
Size
47KB
-
MD5
0b0d852d2befda9d839342949b2f1423
-
SHA1
96a15a25e475818c81a55c0123d1c10ca2de831d
-
SHA256
618a294a9de54eed0c748d39bcb2f63c7da59ae17eac7d7a156d2bf4ea49a170
-
SHA512
dcc258d2f4ed4e596b832e15a7a3d68e15f39bb2f2a5e77f164d17ebc3bbff63a86d9ae08a995329c66a1b226c6acebdabaca5036bea4ea4d403f99285a926fb
-
SSDEEP
768:Xm8UvCgJk8FXqIIjxjM0vJFExTSExy181JNcFsInEJPRI3LheKN5DHtLkfAQvYdS:Q3k89IjxjMAFOT3y18ijEVi3045DHtSJ
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3916 wrote to memory of 3064 3916 rundll32.exe 14 PID 3916 wrote to memory of 3064 3916 rundll32.exe 14 PID 3916 wrote to memory of 3064 3916 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b0d852d2befda9d839342949b2f1423.dll,#11⤵PID:3064
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b0d852d2befda9d839342949b2f1423.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3916