Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19e9563ed50117a1d9aaf35e7444c7aa.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
19e9563ed50117a1d9aaf35e7444c7aa.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
19e9563ed50117a1d9aaf35e7444c7aa.dll
-
Size
190KB
-
MD5
19e9563ed50117a1d9aaf35e7444c7aa
-
SHA1
5c189c583c4e16931c10911f1d007678b0a92156
-
SHA256
617a61a431cc319c8fc24243fbba2a6a51c460ec53c6963c9ff1985d73bdb437
-
SHA512
7e66e3dbfae44e46979f6025a837995a774d5bc903e65cbb467aaabd605b2e9b5ef392516d6a5cf81222b39a7ca646a965ad1673d0c62d02c5107a08d2c66f72
-
SSDEEP
3072:hExG7ypdHRiE6NH1CyM5vOBTDsymJ/7x/u5ENGX/5ooMqqDLy/aFP:hEsephRiE0Exo1KJ/1o/yqqDLu6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1272 wrote to memory of 2652 1272 rundll32.exe 89 PID 1272 wrote to memory of 2652 1272 rundll32.exe 89 PID 1272 wrote to memory of 2652 1272 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19e9563ed50117a1d9aaf35e7444c7aa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19e9563ed50117a1d9aaf35e7444c7aa.dll,#12⤵PID:2652
-