Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 14:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74beb48ec27ea973a2af3c7c9a99d8ab.dll
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
74beb48ec27ea973a2af3c7c9a99d8ab.dll
-
Size
279KB
-
MD5
74beb48ec27ea973a2af3c7c9a99d8ab
-
SHA1
72b837b81572fbc683a05b205ce9bd86b15ebfd3
-
SHA256
bf498e8aaedbcbd1a1dfa4fc9ee4bc85b0ffa8e03b73b7d4b2a78b334165886d
-
SHA512
fe7ae66e88da186a803fecad4ab2faebabb5f955c0ea4255309e4cd9314b97e8a3a4ccd84b42ab5cd41d429edcf58cdd8e9027bb78031eb792d37e913b9ec004
-
SSDEEP
6144:eL37zHO44nDWgRAkPKLAhGQn8xID0DMFfVoxm0hFmKm:ebOJR3PKmGLxe0Dkixm0hFe
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/2528-5-0x0000000010000000-0x000000001006A000-memory.dmp family_gh0strat behavioral2/memory/2528-9-0x0000000010000000-0x000000001006A000-memory.dmp family_gh0strat behavioral2/memory/2528-14-0x0000000010000000-0x000000001006A000-memory.dmp family_gh0strat -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1472 wrote to memory of 2528 1472 rundll32.exe 14 PID 1472 wrote to memory of 2528 1472 rundll32.exe 14 PID 1472 wrote to memory of 2528 1472 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74beb48ec27ea973a2af3c7c9a99d8ab.dll,#11⤵PID:2528
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74beb48ec27ea973a2af3c7c9a99d8ab.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1472