Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll
Resource
win10v2004-20231215-en
General
-
Target
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll
-
Size
397KB
-
MD5
86fe6557f8f2d3758dbb29816eb18a8c
-
SHA1
84612a2dbc60073680a51af7bf4f2a8145980956
-
SHA256
91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6
-
SHA512
a92358a32bcb941373fe83d487ddb4993d4cd249ae793b1a8928fcfbf7220c777082bacde1cccc12b5845a0668f4341e046ffb4892fd2363754fbbf54947256e
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaH:174g2LDeiPDImOkx2LIaH
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3884 rundll32.exe Token: SeTcbPrivilege 3884 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2856 wrote to memory of 3884 2856 rundll32.exe 89 PID 2856 wrote to memory of 3884 2856 rundll32.exe 89 PID 2856 wrote to memory of 3884 2856 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91228a2733fbbf3f8bb444cec5d3df4d771b68b6a2661386b5437183ff5a6af6.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884
-