Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
217dd7c3153655bfba5b6332334dcef6.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
217dd7c3153655bfba5b6332334dcef6.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
217dd7c3153655bfba5b6332334dcef6.dll
-
Size
141KB
-
MD5
217dd7c3153655bfba5b6332334dcef6
-
SHA1
428296ed4c853e3b09bf732bce94079c70bcf899
-
SHA256
746646e3555a96d004eea836da5638fb73958f00100c3d05dd0b5d71e95876f7
-
SHA512
2576457d044500b491a7c347a5ade16e3fa968238ee530217371eebd41977dc55cb0f7867e2c48f15a571fe31d966ef6d947e707758c970e108cb8ccf6970dd6
-
SSDEEP
3072:1ECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:1EvgOP17s/F08OaoCC1vl1V
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4492 wrote to memory of 4404 4492 rundll32.exe 87 PID 4492 wrote to memory of 4404 4492 rundll32.exe 87 PID 4492 wrote to memory of 4404 4492 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\217dd7c3153655bfba5b6332334dcef6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\217dd7c3153655bfba5b6332334dcef6.dll,#12⤵PID:4404
-