Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 10:44
Behavioral task
behavioral1
Sample
437ad2d99d3dfb452dcdfc72f7f4b61f.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
437ad2d99d3dfb452dcdfc72f7f4b61f.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
437ad2d99d3dfb452dcdfc72f7f4b61f.dll
-
Size
59KB
-
MD5
437ad2d99d3dfb452dcdfc72f7f4b61f
-
SHA1
e67f5723a9d9f55d663fe64f41f8642392065bd4
-
SHA256
b8980c20b6e3514c70b112d8c4c9bc23e197ba877fff9cb5939c7399dc66dd85
-
SHA512
7fc4a88f6af21bbb576c6381d690a1eaebbda49704f2fe02685e2e25d565ccf5adb9a9317306c7571a409fee0e202d6d1b65850cd36e30134f2c911e87b8a4d4
-
SSDEEP
1536:GQ3tfgXKoKGf4UGHcSHqBYn4aQc4CQpueGi+n4pz8:VfgXK4zKcSKyCCuuGQ
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4356-0-0x0000000010000000-0x0000000010016000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4448 wrote to memory of 4356 4448 rundll32.exe 88 PID 4448 wrote to memory of 4356 4448 rundll32.exe 88 PID 4448 wrote to memory of 4356 4448 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\437ad2d99d3dfb452dcdfc72f7f4b61f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\437ad2d99d3dfb452dcdfc72f7f4b61f.dll,#12⤵PID:4356
-