Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 04:41
Behavioral task
behavioral1
Sample
28970900cd559a2ae9b25597c2325ede.dll
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
28970900cd559a2ae9b25597c2325ede.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
28970900cd559a2ae9b25597c2325ede.dll
-
Size
7KB
-
MD5
28970900cd559a2ae9b25597c2325ede
-
SHA1
0cdb52fbd336ee6c60e3086a2ef08f6f03fd6f1f
-
SHA256
8b8c952b4899f958e2cfb8743221acbe90e033fc89acb424533495e0da037112
-
SHA512
3e4e020a80ba77f29be4b0177606ec096e975c32faea4e212b619a196c5b550ef0d8b733e0d5ed7369446fa15a555b9b1ab4777c6dd96ddaccae828e564297be
-
SSDEEP
192:GnfAgv9rC9S0hHPaPHiEK0YBLhTrRsqxtW:GIG8SUr0YBLhBBtW
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2840-0-0x0000000010000000-0x0000000010009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2840 rundll32.exe 2840 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4488 wrote to memory of 2840 4488 rundll32.exe 16 PID 4488 wrote to memory of 2840 4488 rundll32.exe 16 PID 4488 wrote to memory of 2840 4488 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28970900cd559a2ae9b25597c2325ede.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28970900cd559a2ae9b25597c2325ede.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4488