Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 11:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17570fdf30fb6b065fae781f35af3493.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
17570fdf30fb6b065fae781f35af3493.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
17570fdf30fb6b065fae781f35af3493.dll
-
Size
99KB
-
MD5
17570fdf30fb6b065fae781f35af3493
-
SHA1
e21e270fc1c0dbbb85a1ecbf3ee5c58aa9da12e4
-
SHA256
4fe53cb1e3c60b6845717416817c65c2bb338179f25bd6c2d5b828e52804b38e
-
SHA512
167aecfd0500fd60f4d3b53d8f20e4f1182a766910188332385cb9c0cbc559cdcebc51c2c6b93ba852c41ccbf48647cb01adad7d48755022e4e49d1505d093c1
-
SSDEEP
1536:uX7ymBrFzlYboUV6ljwkpsIY1IUryK9vprkXK+IhR7vw5m2a3:uumBRzSkUQJiI2IUx9vugRzw5da
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1784 wrote to memory of 4076 1784 rundll32.exe 87 PID 1784 wrote to memory of 4076 1784 rundll32.exe 87 PID 1784 wrote to memory of 4076 1784 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17570fdf30fb6b065fae781f35af3493.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17570fdf30fb6b065fae781f35af3493.dll,#12⤵PID:4076
-