Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11c008028b7b4adc460aa81b816da019.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
11c008028b7b4adc460aa81b816da019.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
11c008028b7b4adc460aa81b816da019.dll
-
Size
312KB
-
MD5
11c008028b7b4adc460aa81b816da019
-
SHA1
cd2ad22603a95f8f096f4f3c99f3fea40ce17dd2
-
SHA256
94e1dc9fc21ff6dd9b90bffc68a2de48481ddd5a42b8db2f3f180385b9f54bd3
-
SHA512
03d17f346be2a297b21e4ff724a2703c6030547af57a5a42b41ec8b7a40ebbb5977c4b003578bc2bf69367dc46358138fc0b4737d81dff1089e7432010d43234
-
SSDEEP
6144:F26EYT7VyVS6T9L4Cbu9CbfNH9sZS6/oVz+UO5r93drmZI/Bq:FYS0VTKCbu9CbVeZS6OSUOL3dCZI/Bq
Score
8/10
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\sysevent.dll" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sysevent.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\sysevent.dll rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 668 wrote to memory of 2760 668 rundll32.exe 14 PID 668 wrote to memory of 2760 668 rundll32.exe 14 PID 668 wrote to memory of 2760 668 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11c008028b7b4adc460aa81b816da019.dll,#11⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:2760
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11c008028b7b4adc460aa81b816da019.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:668