Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 11:42

General

  • Target

    6bb2d88a69af028f9aba80c897b9cf6c.dll

  • Size

    368KB

  • MD5

    6bb2d88a69af028f9aba80c897b9cf6c

  • SHA1

    5472f1cdb228602951553f7d36cfb535e743c915

  • SHA256

    e737c2180807ae910e9d228b5ded5106fac25d1c02e09ad3f67f913db21ce59a

  • SHA512

    55c6e69b02a4cc16538dd5e83d65b833d51bbbf5221d1dc13ee0d7d01b8f4b5005ea0361037c88df15b2071fe8a277f23d879dc27924cd225cf44b48cba1d3fb

  • SSDEEP

    6144:c2lkEurS0HhRvIR40PtPps+JPZQzhEsFFehrKDXSooK6rb4sh7xQCCwp6:xl0hhO4WtPNQNEsDXDXHQkqCc6

Score
1/10

Malware Config

Signatures

  • Modifies registry class 53 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6bb2d88a69af028f9aba80c897b9cf6c.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\6bb2d88a69af028f9aba80c897b9cf6c.dll
      2⤵
      • Modifies registry class
      PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1928-0-0x0000000000400000-0x00000000004EF000-memory.dmp

    Filesize

    956KB

  • memory/1928-1-0x0000000000A90000-0x0000000000A92000-memory.dmp

    Filesize

    8KB

  • memory/1928-2-0x0000000000400000-0x00000000004EF000-memory.dmp

    Filesize

    956KB