Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll
Resource
win10v2004-20231215-en
General
-
Target
69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll
-
Size
397KB
-
MD5
7ad1482ec70b272a3258b0e56c60c3ce
-
SHA1
4ff14106d88d347bf657ab407aa6170a3ee321b0
-
SHA256
69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17
-
SHA512
9b7f72a24a7d3655879bca81968590fd3c70ce6ecf2b1d1cef9cc3b74a39cba4f95d58b4f6e747d8926b2a552e18acedb271d60a4805fcd40197593091ebdd58
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaX:174g2LDeiPDImOkx2LIaX
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3752 rundll32.exe 3752 rundll32.exe 3752 rundll32.exe 3752 rundll32.exe 3752 rundll32.exe 3752 rundll32.exe 3752 rundll32.exe 3752 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3752 rundll32.exe Token: SeTcbPrivilege 3752 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4448 wrote to memory of 3752 4448 rundll32.exe 88 PID 4448 wrote to memory of 3752 4448 rundll32.exe 88 PID 4448 wrote to memory of 3752 4448 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752
-