Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04a0220134a86e5086fc18cce31dbd33.dll
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
04a0220134a86e5086fc18cce31dbd33.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
04a0220134a86e5086fc18cce31dbd33.dll
-
Size
162KB
-
MD5
04a0220134a86e5086fc18cce31dbd33
-
SHA1
0aa29a4a793610ecbbbb10db9ac896cab65f5e4a
-
SHA256
627c9903bc9d0dacc325b03c7580a3cad22f8d95308e2e1dfdaf2db9426ff0bb
-
SHA512
0f725164d023880a4eaa601a6043f87f119d66b2b257efcf7e021d665e2115dc5538a5edb58e5c25d7ed9d274a5fd1d2a2ee5bbd7272b8dfa218193fc2fb8db2
-
SSDEEP
3072:3EZB94/pzXckR9TsCz8fjfkjJmh02zW7GDkHxIswAA:3GABzMg9ngQ1mh07ywItAA
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 30 4476 rundll32.exe 80 4476 rundll32.exe 130 4476 rundll32.exe 150 4476 rundll32.exe 154 4476 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4476 rundll32.exe Token: SeDebugPrivilege 4476 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5068 wrote to memory of 4476 5068 rundll32.exe 14 PID 5068 wrote to memory of 4476 5068 rundll32.exe 14 PID 5068 wrote to memory of 4476 5068 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04a0220134a86e5086fc18cce31dbd33.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04a0220134a86e5086fc18cce31dbd33.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5068