Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 15:57
Behavioral task
behavioral1
Sample
7ac627f5b2f68fcebaf884c45dc3b656.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ac627f5b2f68fcebaf884c45dc3b656.dll
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
7ac627f5b2f68fcebaf884c45dc3b656.dll
-
Size
132KB
-
MD5
7ac627f5b2f68fcebaf884c45dc3b656
-
SHA1
78219c9a1002d56ad18f9fdc99e097dd458a1416
-
SHA256
28ed26ad240ff3e3c40f96af06fcfe4f1fe994e93aacec106c2cf47ce6f3b738
-
SHA512
ee3e9d62e21810a3b3fd301cd191601fa917d1545302a780a3d0dd1e7686dff44c558ac71ba9d916aa83412ff4a81e3ac03fbaa7f38cf54b5d55f3330f86b89d
-
SSDEEP
1536:kfAw0OntG79qNp2qJFTCvBPvqYcQVwfBaUyBi84YzSny:kfdtG79onTCBvqYzVKBaUi5zSy
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4020 wrote to memory of 4076 4020 rundll32.exe 88 PID 4020 wrote to memory of 4076 4020 rundll32.exe 88 PID 4020 wrote to memory of 4076 4020 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ac627f5b2f68fcebaf884c45dc3b656.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ac627f5b2f68fcebaf884c45dc3b656.dll,#12⤵PID:4076
-