Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 03:14
Behavioral task
behavioral1
Sample
25fbf199f9e25c9b57cc7264d9a417fb.dll
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
25fbf199f9e25c9b57cc7264d9a417fb.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
25fbf199f9e25c9b57cc7264d9a417fb.dll
-
Size
93KB
-
MD5
25fbf199f9e25c9b57cc7264d9a417fb
-
SHA1
d7d394fbaab083255d73ea623407ecc87790c9b9
-
SHA256
927722e84bcb0195e4dc1f016de32c7b527231d05c6228db88ff4850ec0d3184
-
SHA512
20fe2880e8163df032179e69d975ff31cdd9bdd8c9f1063279ef8be3beba1cd2ceb94699ae9207eb292114221b7b0e1bae7801989b964f5a48a07dbe6e08117f
-
SSDEEP
1536:2igNDnKkwj2iqevNECP/uMmcKSIfB/OoE4soe/Xp+C6W96knRG:5ChwjVqCSA/Bm9SyB/Ocsj/Xp+C64nRG
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Drivers\beep.sys rundll32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 736 wrote to memory of 2328 736 rundll32.exe 36 PID 736 wrote to memory of 2328 736 rundll32.exe 36 PID 736 wrote to memory of 2328 736 rundll32.exe 36
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\25fbf199f9e25c9b57cc7264d9a417fb.dll,#11⤵
- Drops file in Drivers directory
PID:2328
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\25fbf199f9e25c9b57cc7264d9a417fb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:736