Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
18b30f3bceb281ea073ffa668a56ca8bc328b7ab01e4cedece3e3eb66214136e.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
18b30f3bceb281ea073ffa668a56ca8bc328b7ab01e4cedece3e3eb66214136e.dll
Resource
win10v2004-20231222-en
General
-
Target
18b30f3bceb281ea073ffa668a56ca8bc328b7ab01e4cedece3e3eb66214136e.dll
-
Size
968KB
-
MD5
d8d5a23fea07be98e316d53c906fd68c
-
SHA1
cc1b849d69a6b37e50d247a63fdfd9e31dff4b07
-
SHA256
18b30f3bceb281ea073ffa668a56ca8bc328b7ab01e4cedece3e3eb66214136e
-
SHA512
6b2c65ed2515a32ac71d5b2992d691790f692d11216c1fa639d1d1467d9c82f6aa53b31163a4e86d79751bda7f449d99f6315d3db221f79b64e7f5a8ccd0270e
-
SSDEEP
24576:YOQgOF2ikXc6bHpa7QhKspQ59VQFwqlSHCTchvCmUI04ylyPMvJQWZ1Wzx:rg6Fa7QhKspy
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 3 2840 rundll32.exe 29 2840 rundll32.exe 43 2840 rundll32.exe 46 2840 rundll32.exe 49 2840 rundll32.exe 53 2840 rundll32.exe -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2840 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3652 wrote to memory of 2840 3652 rundll32.exe 14 PID 3652 wrote to memory of 2840 3652 rundll32.exe 14 PID 3652 wrote to memory of 2840 3652 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\18b30f3bceb281ea073ffa668a56ca8bc328b7ab01e4cedece3e3eb66214136e.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx
PID:2840
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\18b30f3bceb281ea073ffa668a56ca8bc328b7ab01e4cedece3e3eb66214136e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3652