Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll
Resource
win10v2004-20231215-en
General
-
Target
b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll
-
Size
397KB
-
MD5
f19bbb56af51461046430a74d0d67655
-
SHA1
1ac809b04e7402c74cd8af92af20173e1c117286
-
SHA256
b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0
-
SHA512
e6d4bfa89d0bfcbed1d10762450d61dbca5bede3a7c69d225dbdf4f69e9cefc1e28435c8a2ca90d3966799efff90fb55d1887dd79fa352d4a82706d5d18618ac
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOar:174g2LDeiPDImOkx2LIar
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4824 rundll32.exe Token: SeTcbPrivilege 4824 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1936 wrote to memory of 4824 1936 rundll32.exe 14 PID 1936 wrote to memory of 4824 1936 rundll32.exe 14 PID 1936 wrote to memory of 4824 1936 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1936