Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
196s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll
Resource
win10v2004-20231215-en
General
-
Target
3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll
-
Size
397KB
-
MD5
7196e3ceb651bcf701f33ba975054bbf
-
SHA1
ad8ab3bf3bb08bca42f04371abe703e77e6703c7
-
SHA256
3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18
-
SHA512
45f614cdef3d2527182c3403c64c2ce27512f05dd3fcca4e1013a9caf8d74338c496aad297135c40a4c07309c8180b66c22dacdb27bcc7aaf058ea55e10897bf
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaU:174g2LDeiPDImOkx2LIaU
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1208 rundll32.exe Token: SeTcbPrivilege 1208 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 656 wrote to memory of 1208 656 rundll32.exe 85 PID 656 wrote to memory of 1208 656 rundll32.exe 85 PID 656 wrote to memory of 1208 656 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208
-