Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
fe71aad332369a3bcd2817205bdc43f7d74922e44b17635fd0f283def135cf1d.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fe71aad332369a3bcd2817205bdc43f7d74922e44b17635fd0f283def135cf1d.dll
Resource
win10v2004-20231215-en
General
-
Target
fe71aad332369a3bcd2817205bdc43f7d74922e44b17635fd0f283def135cf1d.dll
-
Size
51KB
-
MD5
df2506c4863c5ce564603d0c32efd2a8
-
SHA1
e26a43abe4a5dc6934a2d4bc671e9d0bdcb8e1a3
-
SHA256
fe71aad332369a3bcd2817205bdc43f7d74922e44b17635fd0f283def135cf1d
-
SHA512
0000751933993cdc56a76316726bc692fcd9e8fdda46577420e2b8d2c7b8e07fa592112dd47ad75f52cde9a5042b4adc0b9ae0f1a397caaa70118635b798fe2e
-
SSDEEP
768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezKsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBVpMC6H
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4136 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 440 wrote to memory of 4136 440 rundll32.exe 88 PID 440 wrote to memory of 4136 440 rundll32.exe 88 PID 440 wrote to memory of 4136 440 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe71aad332369a3bcd2817205bdc43f7d74922e44b17635fd0f283def135cf1d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe71aad332369a3bcd2817205bdc43f7d74922e44b17635fd0f283def135cf1d.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4136
-