Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
005d3e3f45afb72606cbaffba7c87be2.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
005d3e3f45afb72606cbaffba7c87be2.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
005d3e3f45afb72606cbaffba7c87be2.dll
-
Size
9KB
-
MD5
005d3e3f45afb72606cbaffba7c87be2
-
SHA1
379ce2d29438d25788b494cf19c844c4105741bd
-
SHA256
25f4419bde591f4b2c29dfa1d66abee7e359cf4dd85f372dbb2edcc313c8dd0c
-
SHA512
7ab5a5005224d8525283a6e844a872fb383a7c500b5fe4e011f22879818b812dbdebc1b4af9f68e6dad2f7453f808bf86dc1c7fef83184dc58cb54cec1baef1b
-
SSDEEP
96:Hf6JYIUNI7kCKWEoA45ALeJE4j2TtVsGCYQ132lc/yrKhYq2w3G5ys5NmyZ:/6JMvgjAL0E9VsG3+/yAJgh
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3800 wrote to memory of 1052 3800 rundll32.exe 14 PID 3800 wrote to memory of 1052 3800 rundll32.exe 14 PID 3800 wrote to memory of 1052 3800 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\005d3e3f45afb72606cbaffba7c87be2.dll,#11⤵PID:1052
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\005d3e3f45afb72606cbaffba7c87be2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3800