Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 11:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c3e7007f1a2e336da4ef6a9b19e183e.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c3e7007f1a2e336da4ef6a9b19e183e.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
6c3e7007f1a2e336da4ef6a9b19e183e.dll
-
Size
37KB
-
MD5
6c3e7007f1a2e336da4ef6a9b19e183e
-
SHA1
2d6bdce81b75377c16466d6b3241dff3d1d7c9e1
-
SHA256
b946b76c0c22d0a9f25b469e3ea2398fa520c7ff0ca53441731a3176af22d49e
-
SHA512
c25846e9528148f74d7f4323af2628d40be0070b966959c1e378716a6e2829406130356054ad5b0a71c9d6451c26905f6396cb29c4ec050df832301763c27284
-
SSDEEP
768:O261TE6fOsGhuhDgboSz/Kb+2AMCXQMN8f:x61LfmQSrKaq
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3772 wrote to memory of 4932 3772 rundll32.exe 14 PID 3772 wrote to memory of 4932 3772 rundll32.exe 14 PID 3772 wrote to memory of 4932 3772 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6c3e7007f1a2e336da4ef6a9b19e183e.dll,#11⤵PID:4932
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6c3e7007f1a2e336da4ef6a9b19e183e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3772