Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 04:11

General

  • Target

    27a066d7dd39e0032726e1fc18b537b8.dll

  • Size

    226KB

  • MD5

    27a066d7dd39e0032726e1fc18b537b8

  • SHA1

    24c43dcde4642d0053825348c40756fbd0877320

  • SHA256

    7483dd2b95c9efcde685ade70b1a98d64ae8854bac028d30f2bf50b077dda9bd

  • SHA512

    bbc8ac0c049945d11343850a4ac61efecc28af98919d6d88a10fdc7182b6367224e404b606c14d2e0afa4ded851333ee78acea35f8a2b8a6b8379eda5eafe29d

  • SSDEEP

    6144:Ow1CW3e0dZfFgCZTdsmnElW0lttHLlEUkiXT:OwD1dTdxGmnOW0ROUdT

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a066d7dd39e0032726e1fc18b537b8.dll,#1
    1⤵
    • Blocklisted process makes network request
    PID:5076
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a066d7dd39e0032726e1fc18b537b8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5076-0-0x0000000013100000-0x0000000013147000-memory.dmp

    Filesize

    284KB

  • memory/5076-10-0x0000000002900000-0x0000000002A40000-memory.dmp

    Filesize

    1.2MB

  • memory/5076-11-0x00000000009D0000-0x00000000009D1000-memory.dmp

    Filesize

    4KB

  • memory/5076-9-0x0000000002900000-0x0000000002A40000-memory.dmp

    Filesize

    1.2MB

  • memory/5076-8-0x00000000008C0000-0x00000000008C1000-memory.dmp

    Filesize

    4KB

  • memory/5076-7-0x0000000002340000-0x0000000002341000-memory.dmp

    Filesize

    4KB

  • memory/5076-23-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/5076-25-0x00000000023D0000-0x00000000023D1000-memory.dmp

    Filesize

    4KB

  • memory/5076-26-0x0000000002360000-0x0000000002362000-memory.dmp

    Filesize

    8KB

  • memory/5076-24-0x0000000002450000-0x0000000002451000-memory.dmp

    Filesize

    4KB

  • memory/5076-22-0x0000000002430000-0x0000000002431000-memory.dmp

    Filesize

    4KB

  • memory/5076-21-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/5076-20-0x0000000002420000-0x0000000002421000-memory.dmp

    Filesize

    4KB

  • memory/5076-19-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/5076-18-0x0000000002380000-0x0000000002381000-memory.dmp

    Filesize

    4KB

  • memory/5076-17-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/5076-16-0x0000000002390000-0x0000000002391000-memory.dmp

    Filesize

    4KB

  • memory/5076-15-0x00000000023F0000-0x00000000023F1000-memory.dmp

    Filesize

    4KB

  • memory/5076-14-0x0000000002370000-0x0000000002371000-memory.dmp

    Filesize

    4KB

  • memory/5076-13-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/5076-12-0x00000000023B0000-0x00000000023B1000-memory.dmp

    Filesize

    4KB

  • memory/5076-6-0x00000000008B0000-0x00000000008B1000-memory.dmp

    Filesize

    4KB

  • memory/5076-5-0x00000000009F0000-0x00000000009F1000-memory.dmp

    Filesize

    4KB

  • memory/5076-4-0x00000000008A0000-0x00000000008A1000-memory.dmp

    Filesize

    4KB

  • memory/5076-3-0x0000000002330000-0x0000000002331000-memory.dmp

    Filesize

    4KB

  • memory/5076-2-0x00000000009E0000-0x00000000009E1000-memory.dmp

    Filesize

    4KB

  • memory/5076-1-0x0000000000A30000-0x0000000000A7B000-memory.dmp

    Filesize

    300KB